CVE-2026-111649: Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint

Q: Who can exploit this issue?

An attacker needs to be authenticated with a paopao-ce account and able to make requests to the /v1/attachment endpoint. No user interaction from the victim is required.

Q: What data could be exposed?

Authenticated attackers can obtain signed download URLs for media and attachments belonging to other users, including content marked private, friend-only, or following-only. This includes images, videos, and other attachments.

Q: How would an attacker identify target attachments?

The issue permits arbitrary content IDs to be supplied to the endpoint. Attackers can enumerate sequential post_content IDs to discover attachments associated with other users.

Q: Are deployments affected by default?

The available information identifies the vulnerable behavior in paopao-ce through 0.6.0-alpha.3, but does not state that any particular configuration prevents it. Access controls on private, friend-only, and following-only media can be bypassed by an authenticated user.

Published Oct 16, 2026

Updated

Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential postcontent ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.

Affected Software

1 affected component

ROCBOSS paopao-ce<=0.6.0-alpha.3

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be authenticated with a paopao-ce account and able to make requests to the /v1/attachment endpoint. No user interaction from the victim is required.

What data could be exposed?

Authenticated attackers can obtain signed download URLs for media and attachments belonging to other users, including content marked private, friend-only, or following-only. This includes images, videos, and other attachments.

How would an attacker identify target attachments?

The issue permits arbitrary content IDs to be supplied to the endpoint. Attackers can enumerate sequential post_content IDs to discover attachments associated with other users.

Are deployments affected by default?

The available information identifies the vulnerable behavior in paopao-ce through 0.6.0-alpha.3, but does not state that any particular configuration prevents it. Access controls on private, friend-only, and following-only media can be bypassed by an authenticated user.

CVE-2026-111649: Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed?

How would an attacker identify target attachments?

Are deployments affected by default?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed?

How would an attacker identify target attachments?

Are deployments affected by default?