CVE-2026-123617

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-123617
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123617.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-123617
Aliases
  • GHSA-hfg3-vq24-hprp
Published
2026-11-06T15:00:53Z
Modified
2026-11-07T02:48:24Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Openwhyd before 1.65.1 NoSQL Injection via POST /api/user
Details

Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-943"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123617.json"
}
References

Affected packages

Git / github.com/openwhyd/openwhyd

Affected ranges

Type
GIT
Repo
https://github.com/openwhyd/openwhyd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
26d9cbb548c2b06e09c9b5c505bd07f53274fa05
Fixed
167c45d6754df0adb3415f71cbd7cde91cbe7874
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.65.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "167c45d6754df0adb3415f71cbd7cde91cbe7874"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.65.1",
            "range": [
                {
                    "fixed": "26d9cbb548c2b06e09c9b5c505bd07f53274fa05"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.10.0
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.14.4
v1.14.5
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.15.4
v1.16.0
v1.17.0
v1.17.1
v1.17.3
v1.18.0
v1.18.1
v1.19.0
v1.19.1
v1.19.2
v1.2.0
v1.2.1
v1.2.2
v1.20.0
v1.21.0
v1.21.1
v1.21.2
v1.21.3
v1.21.4
v1.22.0
v1.22.1
v1.23.0
v1.24.0
v1.24.1
v1.25.0
v1.25.1
v1.25.2
v1.26.0
v1.26.1
v1.26.2
v1.26.3
v1.26.4
v1.27.1
v1.27.2
v1.27.3
v1.27.4
v1.27.5
v1.27.6
v1.27.7
v1.28.0
v1.28.1
v1.28.2
v1.29.0
v1.3.0
v1.30.0
v1.30.1
v1.30.2
v1.30.3
v1.30.4
v1.30.5
v1.30.6
v1.31.0
v1.32.0
v1.33.0
v1.33.1
v1.33.2
v1.33.3
v1.33.4
v1.33.5
v1.33.6
v1.34.0
v1.34.1
v1.34.10
v1.34.11
v1.34.12
v1.34.13
v1.34.14
v1.34.15
v1.34.16
v1.34.17
v1.34.18
v1.34.19
v1.34.2
v1.34.20
v1.34.21
v1.34.22
v1.34.23
v1.34.3
v1.34.4
v1.34.5
v1.34.6
v1.34.7
v1.34.8
v1.34.9
v1.35.0
v1.35.1
v1.35.2
v1.35.3
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.37.6
v1.37.7
v1.38.0
v1.39.0
v1.39.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.40.0
v1.40.1
v1.40.2
v1.40.3
v1.40.4
v1.40.5
v1.40.6
v1.41.0
v1.41.1
v1.42.0
v1.42.1
v1.42.2
v1.42.3
v1.42.4
v1.42.5
v1.42.6
v1.42.7
v1.43.0
v1.43.1
v1.44.0
v1.44.1
v1.44.10
v1.44.11
v1.44.12
v1.44.13
v1.44.14
v1.44.15
v1.44.16
v1.44.17
v1.44.18
v1.44.19
v1.44.2
v1.44.20
v1.44.21
v1.44.22
v1.44.23
v1.44.24
v1.44.25
v1.44.26
v1.44.27
v1.44.28
v1.44.29
v1.44.3
v1.44.30
v1.44.31
v1.44.32
v1.44.33
v1.44.34
v1.44.35
v1.44.36
v1.44.37
v1.44.38
v1.44.39
v1.44.40
v1.44.41
v1.44.42
v1.44.43
v1.44.44
v1.44.45
v1.44.46
v1.44.48
v1.44.49
v1.44.5
v1.44.50
v1.44.51
v1.44.52
v1.44.53
v1.44.54
v1.44.55
v1.44.56
v1.44.57
v1.44.6
v1.44.7
v1.44.8
v1.44.9
v1.45.0
v1.45.1
v1.45.10
v1.45.11
v1.45.12
v1.45.13
v1.45.2
v1.45.3
v1.45.4
v1.45.5
v1.45.6
v1.45.7
v1.45.8
v1.45.9
v1.46.0
v1.46.1
v1.46.10
v1.46.11
v1.46.2
v1.46.3
v1.46.4
v1.46.5
v1.46.7
v1.46.8
v1.46.9
v1.47.0
v1.47.1
v1.48.0
v1.48.1
v1.48.10
v1.48.11
v1.48.12
v1.48.13
v1.48.14
v1.48.15
v1.48.16
v1.48.2
v1.48.3
v1.48.4
v1.48.5
v1.48.6
v1.48.7
v1.48.8
v1.48.9
v1.49.0
v1.49.1
v1.49.10
v1.49.11
v1.49.12
v1.49.13
v1.49.14
v1.49.15
v1.49.16
v1.49.17
v1.49.18
v1.49.19
v1.49.2
v1.49.20
v1.49.21
v1.49.22
v1.49.23
v1.49.24
v1.49.25
v1.49.26
v1.49.27
v1.49.28
v1.49.29
v1.49.3
v1.49.30
v1.49.31
v1.49.4
v1.49.5
v1.49.6
v1.49.7
v1.49.8
v1.49.9
v1.5.0
v1.50.0
v1.50.1
v1.50.10
v1.50.11
v1.50.12
v1.50.13
v1.50.14
v1.50.2
v1.50.3
v1.50.4
v1.50.5
v1.50.6
v1.50.7
v1.50.8
v1.50.9
v1.51.0
v1.51.1
v1.51.2
v1.51.3
v1.51.4
v1.51.5
v1.51.6
v1.51.7
v1.51.8
v1.51.9
v1.52.0
v1.52.1
v1.52.10
v1.52.11
v1.52.12
v1.52.13
v1.52.14
v1.52.15
v1.52.16
v1.52.17
v1.52.2
v1.52.3
v1.52.4
v1.52.5
v1.52.6
v1.52.7
v1.52.8
v1.52.9
v1.53.0
v1.54.0
v1.55.0
v1.55.1
v1.55.10
v1.55.11
v1.55.12
v1.55.13
v1.55.14
v1.55.15
v1.55.16
v1.55.17
v1.55.18
v1.55.19
v1.55.2
v1.55.20
v1.55.21
v1.55.22
v1.55.23
v1.55.24
v1.55.25
v1.55.26
v1.55.27
v1.55.28
v1.55.29
v1.55.3
v1.55.30
v1.55.31
v1.55.32
v1.55.33
v1.55.34
v1.55.35
v1.55.36
v1.55.37
v1.55.38
v1.55.39
v1.55.4
v1.55.40
v1.55.41
v1.55.42
v1.55.43
v1.55.44
v1.55.45
v1.55.46
v1.55.47
v1.55.48
v1.55.49
v1.55.5
v1.55.50
v1.55.51
v1.55.52
v1.55.53
v1.55.54
v1.55.55
v1.55.56
v1.55.57
v1.55.58
v1.55.59
v1.55.6
v1.55.60
v1.55.61
v1.55.62
v1.55.63
v1.55.64
v1.55.65
v1.55.7
v1.55.8
v1.55.9
v1.56.0
v1.56.1
v1.56.2
v1.56.3
v1.56.4
v1.56.5
v1.56.6
v1.56.7
v1.56.8
v1.57.0
v1.57.1
v1.58.0
v1.58.1
v1.58.2
v1.58.3
v1.59.0
v1.59.1
v1.59.10
v1.59.11
v1.59.12
v1.59.13
v1.59.14
v1.59.15
v1.59.16
v1.59.17
v1.59.18
v1.59.19
v1.59.2
v1.59.20
v1.59.21
v1.59.22
v1.59.3
v1.59.4
v1.59.5
v1.59.6
v1.59.7
v1.59.8
v1.59.9
v1.6.0
v1.6.1
v1.6.2
v1.60.0
v1.60.1
v1.60.2
v1.60.3
v1.60.4
v1.61.0
v1.61.1
v1.61.2
v1.61.3
v1.61.4
v1.61.5
v1.62.0
v1.62.1
v1.63.0
v1.63.1
v1.63.10
v1.63.11
v1.63.12
v1.63.13
v1.63.14
v1.63.15
v1.63.16
v1.63.17
v1.63.18
v1.63.19
v1.63.2
v1.63.20
v1.63.21
v1.63.22
v1.63.23
v1.63.24
v1.63.25
v1.63.26
v1.63.27
v1.63.28
v1.63.29
v1.63.3
v1.63.30
v1.63.31
v1.63.32
v1.63.33
v1.63.34
v1.63.35
v1.63.36
v1.63.37
v1.63.38
v1.63.39
v1.63.4
v1.63.5
v1.63.6
v1.63.7
v1.63.8
v1.63.9
v1.64.0
v1.64.1
v1.64.10
v1.64.11
v1.64.12
v1.64.13
v1.64.14
v1.64.15
v1.64.16
v1.64.17
v1.64.18
v1.64.19
v1.64.2
v1.64.20
v1.64.21
v1.64.22
v1.64.23
v1.64.24
v1.64.25
v1.64.26
v1.64.27
v1.64.28
v1.64.29
v1.64.3
v1.64.30
v1.64.31
v1.64.32
v1.64.33
v1.64.34
v1.64.35
v1.64.36
v1.64.37
v1.64.4
v1.64.5
v1.64.6
v1.64.7
v1.64.8
v1.64.9
v1.65.0
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123617.json"