CVE-2026-84430: gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gouguoa edit_personal Endpoint (file app/home/controller/Index.php, function update)to a version that resolves this vulnerability.Fixed in 6.0.3
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects gouguoa versions up to 5.10.0 and 6.0.1 in the edit_personal endpoint, specifically the update function in app/home/controller/Index.php.
What access does an attacker need?
The vulnerability can be exploited remotely with low attack complexity, but it requires low-level privileges. No user interaction is required.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What version resolves the issue?
Upgrade to version 6.0.3 to resolve the vulnerability.