Threat database

pig versions up to and including 4.1.1 have a missing authorization vulnerability in the SysUserController.user endpoint. This flaw allows any authenticated user to access other users' profile details via a GET request to /admin/user/details/{id}. Attackers with low privileges can enumerate user IDs sequentially to obtain sensitive information such as usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

CVE-2026-15512 is a code injection vulnerability in pig-mesh Pig affecting versions 3.9.0, 3.9.1, and 3.9.2. The issue exists in the pig-codegen component, specifically in GeneratorServiceImpl.java. The vulnerability allows remote attackers to inject code. The vendor has not responded to the disclosure, and no official patch or remediation is currently available. The CVSS 4.0 score rates this as a medium severity issue.