MEDIUM 6.9 NVD
CVE-2026-66091
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
References
- https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw
- https://openequella.github.io/guides/
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-29 via NVD.
vulnfeed aggregates 17714 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.