SakaiProject Sakai up to 23.4/25.2 Profile Image Deletion image ProfileController.removeProfileImage userId improper authorization

Summaryinfo

A vulnerability was found in SakaiProject Sakai up to 23.4/25.2. It has been rated as problematic. Impacted is the function ProfileController.removeProfileImage of the file /api/users/{userId}/profile/image of the component Profile Image Deletion. The manipulation of the argument userId leads to improper authorization. This vulnerability is listed as CVE-2026-54050. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SakaiProject Sakai up to 23.4/25.2. This issue affects the function ProfileController.removeProfileImage of the file /api/users/{userId}/profile/image of the component Profile Image Deletion. The manipulation of the argument userId with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. The summary by CVE is:

Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-54050 since 06/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 23.5 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Vendor

• SakaiProject

Name

• Sakai

Version

• 23.0
• 23.1
• 23.2
• 23.3
• 23.4
• 25.0
• 25.1
• 25.2

Website

• Product: https://github.com/sakaiproject/sakai/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion