CVE-2026-71854: OpenAEV has unauthenticated access and missing object-level authorization on player lessons API
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be called without authentication, and they trust a client-supplied userId query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenAEVto a version that resolves this vulnerability.Fixed in 2.260622.0
Event History
Frequently Asked Questions
Are default OpenAEV installations exposed?
Yes. Before version 2.260622.0, the affected lessons endpoints under /api/player/** are accessible without authentication on a default installation.
What does an attacker need to exploit this issue?
An attacker needs to know an exercise UUID. They do not need an account or authentication, and can supply an arbitrary userId query parameter.
What could an attacker do with a known exercise UUID?
They can read lessons-learned questions and answers, including each answer's author identity. They can also create or overwrite answers while attributing them to an arbitrary user.
Which version fixes the issue?
Version 2.260622.0 contains the patch.