CVE-2026-111343 in pig
Summary
by MITRE • 10/16/2026
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Pig framework versions up through 4.1.1 represents a critical failure in access control mechanisms within the SysUserController component. Specifically, the endpoint responsible for retrieving user profile details via GET /admin/user/details/{id} lacks proper authorization checks to verify whether the requesting authenticated user has permission to view the data associated with the specified identifier. This flaw allows any logged-in account, regardless of its privilege level or administrative status, to access sensitive personal information belonging to other users within the system. The absence of an ownership verification step means that the application blindly trusts the id parameter provided in the request without validating if the requester is authorized to view resources owned by others.
This technical flaw falls squarely under CWE-284 Improper Access Control and aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate authentication credentials to perform unauthorized actions. The operational impact of this vulnerability is significant because it enables low-privilege attackers to conduct user enumeration attacks effectively. By iterating through sequential integer values for the {id} parameter in the URL path, an attacker can systematically harvest a comprehensive dataset including usernames, real names, phone numbers, email addresses, linked third-party account identifiers, and role assignments. This process requires no special privileges or complex exploitation techniques beyond standard HTTP requests made by any authenticated user.
The exposure of such detailed personal information facilitates further malicious activities such as targeted phishing campaigns, social engineering attacks, and credential stuffing attempts using the harvested contact details. Furthermore, knowledge of internal role assignments can aid attackers in mapping out the organizational structure within the application, allowing them to identify high-value targets or potential escalation paths for privilege abuse. The ability to enumerate users also aids in reconnaissance efforts during broader penetration testing scenarios where initial access has been gained but lateral movement is required.
To mitigate this vulnerability, developers must implement strict authorization checks on all endpoints that handle sensitive user data. This involves verifying that the authenticated principal matches the owner of the resource being requested or possesses specific administrative privileges necessary to view other users' profiles. Implementing role-based access control (RBAC) policies ensures that only authorized roles can execute these operations. Additionally, applying rate limiting and monitoring for sequential ID requests can help detect and block automated enumeration attempts in real-time. Regular security audits and static code analysis focused on access control logic are essential to prevent similar flaws from being introduced into the application architecture.