Description
Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
Published: 2026-11-06
Score: 6.9 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
Description Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
Title Openwhyd before 1.65.1 NoSQL Injection via POST /api/user
First Time appeared Openwhyd
Openwhyd openwhyd
Weaknesses CWE-943
CPEs cpe:2.3:a:openwhyd:openwhyd:*:*:*:*:*:*:*:*
Vendors & Products Openwhyd
Openwhyd openwhyd
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Openwhyd Openwhyd
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-06T15:00:53.519Z

Reserved: 2026-11-06T01:04:42.201Z

Link: CVE-2026-123617

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T15:17:19.017

Modified: 2026-11-06T15:17:19.017

Link: CVE-2026-123617

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-943

    Improper Neutralization of Special Elements in Data Query Logic