CVE-2026-111722: LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any self-registered user can exploit it. The attacker does not need victim interaction and can enumerate numeric project IDs to target projects belonging to other users.
Which operations can an attacker perform against another user's project?
The affected GET, PUT, and DELETE endpoints can be used to read project data, overwrite it, reassign it, or delete it. The vulnerable endpoint is /admin/v1/projects/:id.
Are deployments affected by default?
The issue affects LingGuo-Drama through commit 8a6924a where project retrieval lacks an owner check. The provided data does not identify any configuration prerequisite beyond having registered users able to access the affected API.
How can I determine whether a deployment is vulnerable?
Review the project access path used by /admin/v1/projects/:id and verify that projects.Get enforces ownership before GET, PUT, or DELETE operations proceed. If a low-privileged registered account can access a project using another user's numeric ID, the deployment is affected.