CVE-2026-123617: Openwhyd before 1.65.1 NoSQL Injection via POST /api/user
Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated attackers can exploit it by sending crafted requests to the POST /api/user endpoint. No account or prior access is described as necessary.
What does an attacker need to send?
The attacker needs to supply a JSON object in the id parameter containing MongoDB query operators, such as $ne or $gt. This manipulates the user lookup rather than performing a normal identifier lookup.
What data may be exposed?
The issue can be used to select and enumerate other users' public profile records. The provided information does not indicate exposure of non-public profile data.
Which releases are affected and what fixes it?
Openwhyd versions before 1.65.1 are affected. Upgrading to version 1.65.1 or later addresses the issue.