CVE-2026-116018: Authorization Bypass Through User-Controlled Key in ONEARMY community-platform
Affects ONEARMY community-platformSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NWhat to do
AI-suggested
A fix is available in ONEARMY community-platform version 2.165.2 and later. Users should upgrade to version 2.165.2 or above to remediate this vulnerability. No additional mitigation steps are indicated.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| ONEARMYcommunity-platform | Affected
| Fixed in
|
GitHub Actionscommunity-platformpkg:github/community-platformOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
CVE-2026-116018 is an insecure direct object reference vulnerability in ONEARMY community-platform versions before 2.165.2. It allows authenticated users to mark other users' notifications as read by manipulating notification IDs in API requests. This can cause users in the same tenant to miss important notifications such as replies, comments, and new content alerts.
References
- github.com/ONEARMY/community-platform/issues/5022 (opens in a new tab)
- github.com/ONEARMY/community-platform/pull/5011 (opens in a new tab)
- github.com/ONEARMY/community-platform/commit/571732c26caf1a0a46e5335d275cef2e19dfab08 (opens in a new tab)
- github.com/ONEARMY/community-platform/releases/tag/v2.165.2 (opens in a new tab)
- github.com/ONEARMY/community-platform/blob/v2.163.2/src/routes/api.notifications.$id.read.ts (opens in a new tab)
- hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor (opens in a new tab)
- vulncheck.com/advisories/onearmy-community-platform-before-2.165.2-idor-via-notification-read-endpoint (opens in a new tab)