CVE-2026-85210 in Oppia
Summary
by MITRE • 09/03/2026
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified within Oppia's AdminRoleHandler GET endpoint represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. The core issue stems from the application of an open_access decorator to this specific handler located in the core/controllers/admin.py module. In typical web application architectures, administrative endpoints are designed to be accessible only by users with elevated privileges or explicit authorization tokens. However, the presence of the open_access decorator effectively neutralizes these security boundaries, rendering the endpoint publicly queryable by any authenticated user on the platform. This architectural misconfiguration allows unprivileged actors to interact directly with backend logic intended for system administrators, bypassing standard authentication and authorization checks that should restrict such interactions.
The operational impact of this vulnerability is significant due to its potential for information disclosure and privilege enumeration. Attackers can exploit the endpoint by issuing GET requests containing specific filter_criterion parameters. Through these queries, malicious users are able to retrieve sensitive data including usernames associated with privileged roles, flags indicating whether accounts have been banned, and identifiers related to managed topics. This capability facilitates a detailed reconnaissance phase where an attacker maps out the internal structure of user privileges. By enumerating which accounts hold administrative or moderator roles, attackers can prioritize their targets for subsequent attacks such as credential stuffing, social engineering, or targeted exploitation of known vulnerabilities in those specific privileged interfaces. The exposure of banned flags further aids attackers by revealing inactive or restricted accounts that might have weaker security hygiene or outdated credentials.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability directly supports techniques associated with Discovery and Collection. Specifically, it aligns with T1087 Account Discovery, where adversaries gather information about user accounts to identify high-value targets. It also relates to T1606 With Credential Access if the enumerated data is used in conjunction with other attacks to gain unauthorized access. The ability to filter by role allows attackers to efficiently narrow down their attack surface, focusing resources on accounts that provide the highest level of system control. This reduces the noise and effort required for brute-force attempts or phishing campaigns, making subsequent intrusion attempts more efficient and likely to succeed.
To mitigate this vulnerability, immediate remediation is required to enforce strict access controls on administrative endpoints. The open_access decorator must be removed from the AdminRoleHandler GET endpoint and replaced with a mechanism that verifies user roles against an allowlist of authorized administrators only. Implementing role-based access control (RBAC) checks at the handler level ensures that only users possessing specific, verified admin privileges can execute queries related to account management. Additionally, input validation should be strengthened on filter_criterion parameters to prevent potential injection attacks or excessive data retrieval. Logging and monitoring mechanisms should also be enhanced to detect unusual query patterns indicative of enumeration attempts, allowing for rapid incident response if such activity is detected in the future.