CVE-2026-69115: OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69115?
CVE-2026-69115 has a medium severity rating of 6.5.
How does CVE-2026-69115 affect OpenIM Server v3.8.3?
CVE-2026-69115 allows authenticated users to access admin-only management API endpoints without proper authorization.
What can attackers do with CVE-2026-69115?
Attackers can exploit CVE-2026-69115 to enumerate users and groups by sending requests with a regular user bearer token.
How can users protect against CVE-2026-69115?
To protect against CVE-2026-69115, ensure that appropriate access controls are implemented for API endpoints.
When was CVE-2026-69115 published?
CVE-2026-69115 was published on August 11, 2026.