CVE-2026-100514 in REST API Log Plugin
Summary
by MITRE • 10/01/2026
Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an Unauthenticated Insecure Direct Object Reference within the REST API of Log versions prior to 1.7.2 represents a critical failure in access control mechanisms that allows attackers to manipulate object identifiers directly without proper authentication or authorization checks. This flaw stems from the application's reliance on client-supplied input, such as URL parameters or request body fields, to determine which resource should be accessed, while failing to verify whether the authenticated user has permission to view or modify that specific resource. In this unauthenticated context, the severity is amplified significantly because no login credentials are required to exploit the issue, effectively bypassing any intended security boundaries and exposing sensitive data or system functionality to any external actor on the network.
From a technical perspective, the root cause lies in the backend logic of the REST API endpoint responsible for handling log retrieval or management requests. The application likely constructs database queries or file access paths using user-provided identifiers directly, without implementing intermediate authorization checks that map these identifiers to specific user contexts or roles. This design pattern violates fundamental security principles by assuming that the mere presence of a valid identifier implies permission to access it. Consequently, an attacker can systematically iterate through sequential integer values or predictable object IDs in API requests to enumerate and retrieve log entries belonging to other users, administrative accounts, or sensitive system configurations.
The operational impact of this vulnerability is severe, primarily involving the unauthorized disclosure of confidential information stored within the application's logs. These logs may contain personally identifiable information, internal network topology details, authentication tokens, session identifiers, or even plaintext passwords if logging practices are not strictly sanitized. Beyond data leakage, an attacker could potentially manipulate log entries to cover their tracks during a subsequent intrusion, alter system behavior by injecting malicious commands if the logs influence downstream processes, or cause denial of service conditions through resource exhaustion attacks targeting specific high-value objects. The ability to access this data without authentication undermines the integrity and confidentiality guarantees provided by the application architecture.
This vulnerability aligns with CWE-639, which describes Insecure Direct Object References where a web application exposes internal implementation objects such as files or database records via user-supplied input. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, although in this specific case the exploitation occurs without valid credentials due to the lack of authentication requirements on the affected endpoint. The attack vector is classified under Network-Based attacks with Low Complexity, allowing remote code execution or data exfiltration by any network-connected entity capable of sending HTTP requests to the target system.
To mitigate this vulnerability, immediate remediation involves upgrading the Log application to version 1.7.2 or later where these access control flaws have been addressed. In addition to patching, developers must implement robust authorization checks on all API endpoints that handle sensitive resources. This includes enforcing object-level permissions by verifying that the requesting user owns the resource or holds a role with explicit privileges for it. Input validation should also be strengthened to ensure that identifiers are validated against expected formats and ranges, preventing enumeration attacks through sequential ID guessing. Finally, implementing rate limiting and comprehensive audit logging of access attempts can help detect and prevent automated exploitation efforts targeting these endpoints.