CVE-2026-53673: BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a userid parameter in the request. Attackers can pass another user's identifier to the getitempermissionscheck method, which validates the supplied userid instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
Other sources
BuddyPress: Authenticated attackers can access arbitrary private message threads via userid request parameter
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/buddypress/buddypressto a version that resolves this vulnerability.Fixed in 14.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53673?
The severity of CVE-2026-53673 is rated high with a CVSS score of 8.6.
How does CVE-2026-53673 affect BuddyPress users?
CVE-2026-53673 allows authenticated attackers to access arbitrary private message threads by exploiting an insecure direct object reference in the messages REST API.
Who is vulnerable to CVE-2026-53673?
User accounts in BuddyPress 14.4.0 that have been authenticated are vulnerable to CVE-2026-53673.
How do I fix CVE-2026-53673?
To resolve CVE-2026-53673, update BuddyPress to the latest version as recommended by the developers.
Is it possible for attackers to misuse CVE-2026-53673?
Yes, attackers can misuse CVE-2026-53673 to gain unauthorized access to other users' private message threads.