Threats affecting pkg:github/comppolicylab/pingpong

CVE-2026-32097 is a high-severity authorization bypass vulnerability in the PingPong platform by comppolicylab, affecting versions prior to 7.27.2. Authenticated users with minimal permissions can exploit this flaw to retrieve or delete files outside their authorized scope, including private user-uploaded and model-generated files. Exploitation requires authentication and some level of thread access but no user interaction or elevated privileges beyond limited read or participation rights. The vulnerability stems from improper authorization checks related to user-controlled keys, classified under CWE-639. No known exploits are currently reported in the wild, and the issue is fixed in version 7.27.2. Organizations using affected versions should prioritize patching to prevent potential data breaches or data loss.