CVE-2026-85210: Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any registered Oppia user can query the affected GET endpoint. No administrator privileges or user interaction are required.
What information could an attacker obtain?
An attacker can enumerate privileged accounts and roles, including usernames associated with specific roles, banned flags, and managed topic identifiers. The described impact is information disclosure; no integrity or availability impact is stated.
Is an unauthenticated deployment affected?
The endpoint is described as accessible to any registered user, so an attacker must first have a valid user account. The data does not state that unauthenticated users can exploit it.
How can I determine whether my instance is affected?
The issue affects Oppia through version 3.5.2. Review the AdminRoleHandler GET implementation in core/controllers/admin.py and verify whether it is decorated with open_access and permits registered users to retrieve role-filtered account information.