Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php… (CVE-2026-108164)

CVE-2026-108164 describes an insecure direct object reference vulnerability in OSSN through version 10.1 within the components/OssnMessages/ossn_com.php file. Authenticated attackers can exploit this by sequentially or randomly guessing file GUIDs in requests to the /messages/attachment/{guid} route, thereby retrieving attachments from private conversations without verifying if the requester is the sender or recipient. This results in unauthorized disclosure of private message attachments.

The vulnerability allows authenticated users to read private message attachments belonging to other users, leading to a confidentiality breach. There is no indication of integrity or availability impact. The CVSS 3.1 score is 6.5 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected endpoint and monitor authenticated user activity to detect potential exploitation attempts.