CVE-2026-108164 in OSSN
Summary
by MITRE • 10/10/2026
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
Open Source Social Network (OSSN) versions through 10.1 are affected by a critical insecure direct object reference vulnerability located within the components/OssnMessages/ossn_com.php module. This flaw stems from a fundamental failure in access control logic, specifically regarding how the application handles requests for private message attachments. The system exposes an endpoint at /messages/attachment/{guid} which is designed to serve files associated with specific messages. However, the implementation does not adequately verify whether the authenticated user making the request has legitimate ownership or authorized viewing rights for the requested attachment. Instead of checking if the file GUID belongs to a conversation involving the current session's user ID, the server blindly retrieves and serves any file whose identifier matches the provided parameter. This architectural oversight allows an attacker who possesses valid credentials on the platform to bypass intended privacy controls entirely.
The operational impact of this vulnerability is severe for users relying on OSSN for private communications. Because the application fails to perform proper authorization checks before serving content, authenticated attackers can enumerate and download sensitive documents shared in private conversations between other parties. By utilizing sequential guessing or brute-force techniques against file GUIDs, an adversary can systematically iterate through potential identifiers until they locate valid attachments. This capability effectively neutralizes the confidentiality guarantees provided by the messaging feature, as there is no mechanism to restrict access based on relationship status or message ownership. The vulnerability enables unauthorized data exfiltration of potentially sensitive personal information, business documents, or other confidential materials exchanged within the social network environment.
From a classification perspective, this issue aligns directly with CWE-284, which describes Improper Access Control commonly known as Insecure Direct Object Reference (IDOR). The root cause is the reliance on client-supplied input to determine access permissions without server-side validation against user-specific data structures. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques related to Collection and Exfiltration over Application Layer Protocol. Attackers can leverage this flaw during post-exploitation phases to gather intelligence from compromised accounts or internal communications networks. The lack of verification means that the attack does not require complex exploitation chains; it relies solely on basic HTTP requests with manipulated parameters, making it highly accessible even to attackers with limited technical sophistication provided they have a valid account.
Mitigation strategies must focus on implementing robust server-side authorization checks before any file retrieval operation occurs. Developers should ensure that every request for an attachment is validated against the database records linking messages to specific user IDs and conversation participants. The application logic must confirm that the authenticated session's user ID matches either the sender or recipient of the message associated with the requested GUID. Additionally, implementing rate limiting on the attachment endpoint can help mitigate brute-force enumeration attempts by detecting abnormal request patterns from single IP addresses or accounts. Upgrading to a patched version where these access controls are correctly enforced is essential for restoring security integrity. Until patches are applied, administrators should consider restricting public-facing access to messaging components if possible and monitoring logs for unusual sequential access patterns indicative of GUID guessing attacks.