UBUNTU-CVE-2026-125379: Low severity ubuntu/movim vulnerability

Published Nov 10, 2026

Updated

Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide cache before the XMPP authorization check runs.

Affected Software

1 affected component

ubuntu/movim*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated Movim user. Exploitation also requires knowledge of the target post's server, node, and nodeid values.

What information could be exposed?

Restricted posts cached in the pod-wide cache may be read before the XMPP authorization check occurs. This includes cached community-only or contact-only posts.

Which releases are affected?

Movim versions through 0.35.5 are identified as affected.

UBUNTU-CVE-2026-125379: Low severity ubuntu/movim vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which releases are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which releases are affected?