GHSA-hfg3-vq24-hprp: Openwhyd before 1.65.1 NoSQL Injection via POST /api/user

Published Nov 6, 2026

Updated

Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.

Event History

Nov 6, 2026

CVE Published

via OSV·03:00 PM

Data Sourced

via OSV·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker who can send requests to the affected Openwhyd endpoint can exploit it. No account or prior authentication is described as necessary.

What does an attacker need to send to trigger the injection?

The attacker must send a POST request to /api/user with the id parameter supplied as a JSON object rather than an expected scalar value. MongoDB operators such as $ne or $gt can then manipulate the user lookup.

What information could be exposed?

An attacker can select and enumerate other users' public profile records. The provided information does not indicate exposure of non-public profile data.

How can I determine whether an instance is affected?

Openwhyd versions before 1.65.1 are affected. An affected instance exposes POST /api/user and accepts JSON-object values in the id parameter that are passed into user lookups.

GHSA-hfg3-vq24-hprp: Openwhyd before 1.65.1 NoSQL Injection via POST /api/user

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send to trigger the injection?

What information could be exposed?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send to trigger the injection?

What information could be exposed?

How can I determine whether an instance is affected?