CVE-2026-54050

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54050
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54050.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54050
Aliases
Published
2026-09-15T17:09:58Z
Modified
2026-09-17T08:04:59Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image
Details

Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54050.json"
}
References

Affected packages

Git / github.com/sakaiproject/sakai

Affected ranges

Type
GIT
Repo
https://github.com/sakaiproject/sakai
Events
Introduced
5d29a6077bcf22c8a9d2860fd655d7caecf3ab43
Introduced
4e5584bd462efb886ee35704724704460b2f4508
Fixed
a092dbf3dc6bf343131f50007c207a9abd95e852
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "23.0"
        },
        {
            "fixed": "23.5"
        },
        {
            "introduced": "25.0"
        },
        {
            "last_affected": "25.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54050.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "292135069448079761781759291608452041619",
            "length": 645
        },
        "id": "CVE-2026-54050-0564a827",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java",
            "function": "getProfileImageDetails"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "64825415130292172198043174221701049549",
            "length": 283
        },
        "id": "CVE-2026-54050-150ed1bb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java",
            "function": "removeProfileImage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "301122907128876202002970223589104072948",
            "length": 171
        },
        "id": "CVE-2026-54050-26d4630a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java",
            "function": "removeProfileImage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "237592703521276785384576195670929717058",
                "25803431913409818426877088820290961472",
                "251771433612988916953215570058426088978",
                "57947018528034562418492886990498598759",
                "312216269597950555874172652301759899886",
                "168867910587746431150691520605166837715",
                "291155611493757325110879680224352801535",
                "176482782494313016323128516348212019401",
                "335454301542974227604901591547979153523",
                "212173240820079280748900040222478694874",
                "335185905119780238041700155751615523950",
                "20715424469151110509337546311658046427",
                "335220636205516686865665718278643234000",
                "224144494422568441031065135843345028294",
                "331309449277764895566530857277507263294",
                "45292517004303381199999874687998664203",
                "243282152433778734071925465296779667854",
                "85088400934937181651849844245019342028",
                "198913369159162163788292824428497625890",
                "138176883400253335435721866221795256847",
                "88472821676382375810990006433201354440",
                "29865756697006279907239907567160265526",
                "218837609748306492139135824859407618591",
                "79544139344468027657131616237461978199",
                "297875753119136475286402795057607256111",
                "278781517846577379628599202548491356253",
                "328097602999219401366693764141042361763",
                "123830729212058704094202096031938698699",
                "264194153125882339556046718425435864689",
                "327828157969875580097246772249924607457",
                "160349115837526205837818650529945698118",
                "125790453301076299446313730763239983799",
                "138176883400253335435721866221795256847",
                "192395954617205405496323219177047148476",
                "175593248497858003199508566925253275421",
                "142357329783324635664484497352421507025",
                "250421666624047071889132129667334880565",
                "151693366406682531895257526693267952504",
                "292288985333498937508647340279406869472",
                "113204204077559461098121757740323273732",
                "297874225728664442239732578876475387334"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54050-279b734e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "79392077662472707820702605679985951317",
            "length": 635
        },
        "id": "CVE-2026-54050-2b6b3912",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/impl/src/test/org/sakaiproject/profile2/impl/test/ProfileServiceTests.java",
            "function": "setup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "145322542068915487263858422615837452945",
            "length": 585
        },
        "id": "CVE-2026-54050-3292390d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java",
            "function": "putProfileImage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "43188738669636266396645650297625222621",
            "length": 1914
        },
        "id": "CVE-2026-54050-53599d15",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java",
            "function": "setProfileImage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "119900536923498291975269729450372286956",
                "281522528794004341043734103112476731079",
                "40833128464734280932873468996381903441"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54050-58c553bf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/api/src/main/java/org/sakaiproject/profile2/api/ProfileService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "149557919288369831106397953068761907689",
                "208081986310511382129691148635943866612",
                "197080923018133486941287460195902044323",
                "148876670767275858621412747430658348223",
                "107049881573652715918469450418422227929",
                "197381042532217396725346749203191359848",
                "74984171324936542878172168528032578732",
                "30020214373382000517162008560938942000",
                "64896844741782831925432399359771187891",
                "67747069567161644207947515891071834664",
                "106124385507630441128183738276330936466",
                "273064868066444277800138610728403982165",
                "53297630088661255342246341439262119028",
                "164391193255838411959254763089273705103",
                "231008774201898540818125335326238975042",
                "316136514621800205178739883701724701",
                "228969230271887102612097241514791280018",
                "42095645363124285241858803796483095422",
                "296411674106391595594716512166800675104",
                "145103872230823000350909056645247213249",
                "294767021523237099665925636211017365523",
                "321714738385412459654135992551544207493"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54050-9056a504",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/impl/src/test/org/sakaiproject/profile2/impl/test/ProfileServiceTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "133658321633692296833805518293453858907",
            "length": 132
        },
        "id": "CVE-2026-54050-9936a155",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java",
            "function": "removeNamePronunciation"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "238007017879265249882143921692269741766",
                "297978556168802333937958311311580594693",
                "130426725799730390428362649995880075545"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54050-c4234bd7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "webapi/src/main/java/org/sakaiproject/webapi/exception/GlobalExceptionHandler.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "276972070752433183233756286552281903974",
            "length": 731
        },
        "id": "CVE-2026-54050-d2512964",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java",
            "function": "patchProfile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "214009578065296509912454599710540484680",
            "length": 197
        },
        "id": "CVE-2026-54050-ef3fdc46",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java",
            "function": "removePronunciationRecording"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "155769452596479896909557365117119123835",
                "134252943572074938902681901360285290818",
                "53166435041528469787601297220930982366",
                "104039626306194924212487596645717441313",
                "8506691848681316544944361900528852961",
                "17160660786679032912354996987310005872",
                "319208715414078016924889005328195243992",
                "251152483085782212957031183941836988159",
                "252492296496706382640699650860777455051",
                "308573835677217978861036096354261229081",
                "50755118288293614589025602303391407508",
                "145344039729713659530462197916383628105",
                "60460080065253825073785103686349510419",
                "282183731830833930472404045817755358008",
                "1224208902989923748406167528316509745",
                "239348477702600875158081887071151687364",
                "35876284749282727681918568440165462078",
                "100712154835840963763574494906535169097",
                "157744688332510429398614672694115707141",
                "88912709240575729967644881279245694155",
                "319845670817197571791924031638002826471",
                "226904244356426565102617064275307685462",
                "57916515018456481865410268827163187226"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54050-f880fda3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231010272665514206607234409262517807012",
            "length": 1103
        },
        "id": "CVE-2026-54050-ff47dbe2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
        "target": {
            "file": "profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java",
            "function": "saveUserProfile"
        }
    }
]
vanir_signatures_modified 
"2026-09-17T08:04:59Z"