Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.
{
"cna_assigner": "mitre",
"cwe_ids": [
"CWE-425"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/36xxx/CVE-2026-36453.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.1.31"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "f131a616eb990e2b070a8381c3106ae979d40989"
}
],
"source": "REFERENCES_COMMIT"
}
]
}