CVE-2026-54050 is an authorization bypass vulnerability in Sakai's DELETE /api/users/{userId}/profile/image and DELETE /api/users/{userId}/profile/pronunciation endpoints. The ProfileController methods pass an attacker-controlled userId to service methods without verifying that the authenticated user owns the targeted profile data. Consequently, an authenticated user with limited privileges can delete profile images and pronunciation recordings of other users, including administrators and instructors. The upload functionality is unaffected as it enforces ownership checks. Superusers retain intentional authorization to modify other profiles. The vulnerability is resolved in Sakai versions 23.5, 25.3, and 26.0.

Exploitation allows authenticated users to delete profile images and pronunciation recordings of other users without authorization, potentially disrupting workflows that rely on these identity artifacts. There is no impact on confidentiality or availability, but integrity of profile data is compromised. The vulnerability does not allow deletion of profile uploads or other data, and superusers are unaffected as they are authorized to perform these actions.

Upgrade Sakai to version 23.5, 25.3, or 26.0 or later where this issue is fixed. Until upgrade, restrict authenticated user privileges to trusted users only to reduce risk. No other mitigations are documented. The vendor advisory confirms an official fix is available in the stated versions.