Threats tagged 'ghsa-j3j5-5m8v-7gvc'

BuddyPress versions prior to 14.5.0 contain an insecure direct object reference vulnerability in the messages REST API. Authenticated attackers can exploit this flaw by supplying a user_id parameter to access arbitrary private message threads belonging to other users. This vulnerability allows attackers to read, reply to, or delete any user's private messages without proper authorization.