CVE-2026-111343: Missing Authorization in pig-mesh pig

CVE-2026-111343 describes a missing authorization vulnerability in pig through version 4.1.1 within the SysUserController.user function. The vulnerability permits any authenticated user to perform unauthorized read access on other users' profiles by sending GET requests to the /admin/user/details/{id} endpoint. This enables low-privilege attackers to sequentially enumerate user IDs and harvest sensitive personal and account information, including usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments. The CVSS 4.0 base score is 5.3, indicating a medium severity level with network attack vector, low attack complexity, no user interaction, and low impact on confidentiality.

The vulnerability allows unauthorized disclosure of sensitive user information to any authenticated user. This exposure includes personally identifiable information and account details, which could facilitate further attacks such as social engineering or privilege escalation. However, the vulnerability does not allow modification or deletion of data, nor does it impact system integrity or availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /admin/user/details/{id} endpoint to authorized users only and monitor for suspicious enumeration activity.