CVE-2026-53675 in BuddyPress
Summary
by MITRE • 06/10/2026
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary user_id because the get_items_permissions_check method only verifies that the requester is logged in and never checks ownership of the requested list, resulting in disclosure of users' private social connections.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/16/2026
This vulnerability represents a critical access control flaw in BuddyPress version 14.4.0 that falls under the CWE-639 category of Insecure Direct Object Reference. The issue manifests within the friends REST API endpoint where the system fails to properly validate user permissions when accessing friend lists. The get_items_permissions_check method implements a flawed authorization mechanism that only verifies user authentication status without confirming that the requesting user has legitimate access rights to the target user's friend data. This fundamental security gap allows any authenticated attacker to construct malicious API requests targeting arbitrary user identifiers, thereby bypassing the intended access controls that should restrict friend list access to authorized users only.
The operational impact of this vulnerability extends beyond simple data disclosure, as it exposes the social graph relationships within the platform to unauthorized parties. Attackers can systematically enumerate friend lists across multiple user accounts by simply iterating through user_id parameters, potentially mapping out social connections and identifying relationships between users. This information disclosure represents a significant privacy violation that could enable social engineering attacks, stalking behaviors, or targeted phishing campaigns. The vulnerability particularly affects platforms where social connections carry sensitive implications, such as professional networks, community forums, or social media platforms where users expect privacy controls over their social data.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1213.002 for Credential Access: Credentials in Files and T1566.002 for Initial Access: Phishing for Information. The flaw creates a persistent attack surface that requires minimal technical skill to exploit, making it particularly dangerous in environments where users may not be security-aware. The vulnerability exists because the system lacks proper input validation and access control enforcement mechanisms that should verify the requesting user's relationship to the target resource. Security practitioners should note that this type of vulnerability often indicates broader architectural issues with how access controls are implemented across the REST API framework, suggesting that other endpoints may suffer from similar authorization flaws.
Mitigation strategies should focus on implementing robust access control checks that validate user ownership before granting access to friend list data. The system must enforce that users can only access their own friend lists or those lists for which they have explicit permission. This requires modifying the get_items_permissions_check method to include user ownership validation and implementing proper input sanitization to prevent parameter manipulation. Organizations should also consider implementing rate limiting and monitoring for unusual API access patterns that might indicate enumeration attempts. Additionally, comprehensive security testing including automated penetration testing and manual code review should be conducted to identify and remediate similar access control vulnerabilities across the entire application stack. The fix should align with security best practices outlined in OWASP API Security Top 10 and should be validated through proper security assurance processes before deployment.