CVE-2026-108164

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108164

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108164.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108164

Published

2026-10-10T13:55:14Z

Modified

2026-10-28T02:30:45Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route

Details

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108164.json"
}

References

Affected packages

Git / github.com/opensource-socialnetwork/opensource-socialnetwork

Affected ranges

Type

GIT

Repo

https://github.com/opensource-socialnetwork/opensource-socialnetwork

Events

Introduced

Fixed

2e9733d8eaafccdaef3d9b498348c8332e51f48b

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "10.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "2e9733d8eaafccdaef3d9b498348c8332e51f48b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

10.*

10.0

10.1

5.*

5.6

6.*

6.1

6.2

6.3

6.4

6.5

6.5.0

6.6

7.*

7.0

7.1

7.2

7.3

7.4

7.5

7.6

8.*

8.0

8.1

8.2

8.3

8.4

8.5

8.6

8.7

8.8

8.9

9.*

9.0

9.1

9.10

9.11

9.2

9.3

9.4

9.5

9.6

9.7

9.8

9.9

v6.*

v6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108164.json"