CVE-2026-125379: Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read
Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide cache before the XMPP authorization check runs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the affected Movim instance and must know the server, node, and nodeid values for a restricted post. The issue affects cached community or contact-only posts available in the pod-wide cache.
Does exploitation require user interaction or elevated privileges?
No user interaction is required. The attacker needs only a low-privileged authenticated account; no elevated privileges are indicated.
How can administrators determine whether a disclosure may have occurred?
Review access to the Post::ajaxGetPost endpoint for authenticated users requesting server, node, and nodeid combinations associated with restricted posts. The provided information does not specify logging fields or a reliable method to confirm past reads.