CVE-2026-111343: pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user, including a low-privilege account, can exploit it. No user interaction is required.
What does an attacker need to do to access other users' information?
The attacker needs a valid authenticated session and can request GET /admin/user/details/{id} for other users' IDs. Sequential user IDs can be enumerated to retrieve multiple profiles.
What information may be exposed?
Exposed profile data can include usernames, real names, phone numbers, email addresses, linked third-party accounts, and role assignments.
Which versions are identified as affected?
The provided information identifies pig through version 4.1.1 as affected.