CVE-2026-66091: Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can query the affected endpoint. The attacker needs another user’s uniqueId and can retrieve details for users in the same institution.
What information can be disclosed?
The endpoint can disclose the targeted user’s username, first name, last name, and email address.
Which deployments are affected?
openEQUELLA versions before 2026.1 are affected. The vulnerable endpoint has no authentication or authorization check, so exposure does not depend on a logged-in account.