CVE-2026-111649: Authorization Bypass Through User-Controlled Key in rocboss paopao-ce
Description
CVE-2026-111649 is an authorization bypass vulnerability in rocboss paopao-ce versions up to 0.6.0-alpha.3. Authenticated users can exploit an insecure direct object reference in the DownloadAttachment function to access private media belonging to other users by supplying arbitrary content IDs. This allows enumeration of sequential post_content IDs via the /v1/attachment endpoint, enabling access to private, friend-only, and following-only images, videos, and attachments.
CVSS v4.0
Score 7.1high
Affected software
rocboss
paopao-ce
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rocboss paopao-ce through version 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in the DownloadAttachment feature. Authenticated attackers can enumerate sequential post_content IDs through the /v1/attachment endpoint and supply arbitrary content IDs to obtain signed download URLs for private media of other users, including friend-only and following-only restricted content. This bypasses intended authorization controls, exposing sensitive media to unauthorized users.
Potential Impact
Authenticated users can access private media files of other users without proper authorization. This compromises user privacy by exposing friend-only and following-only restricted images, videos, and attachments. The vulnerability does not require user interaction or elevated privileges beyond authentication, increasing the risk of unauthorized data disclosure.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /v1/attachment endpoint to trusted users only or implement additional access control checks on content ID parameters to prevent unauthorized enumeration and access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:14.725Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264112cdf04f656199578
Added to database: 10/16/2026, 17:51:13 UTC
Last enriched: 10/16/2026, 18:33:27 UTC
Last updated: 10/16/2026, 19:03:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.