Threats tagged 'ghsa-wmjr-58rf-xgrc'

BuddyPress version 14.4.0 and earlier contains an insecure direct object reference (IDOR) vulnerability in its friends REST API. This flaw allows any authenticated user to enumerate the complete friend list of another user by querying the friends endpoint with an arbitrary user ID. The vulnerability exists because the permission check only verifies that the requester is logged in, without verifying ownership of the requested friend list. This leads to unauthorized disclosure of users' private social connections.