CVE-2026-71854

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-71854

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71854.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-71854

Aliases

GHSA-47wr-wp4h-8v3f

Published

2026-10-14T20:05:05Z

Modified

2026-10-28T02:31:13Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

OpenAEV has unauthenticated access and missing object-level authorization on player lessons API

Details

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/** lessons endpoints can be called without authentication, and they trust a client-supplied userId query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-306",
        "CWE-639",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71854.json"
}

References

Affected packages

Git / github.com/openaev-platform/openaev

Affected ranges

Type

GIT

Repo

https://github.com/openaev-platform/openaev

Events

Introduced

Fixed

6fa23d70a808cb3c5a38da63b95577a3eb10ca41

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.260622.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.260622.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.1.1

1.10.0

1.12.0

1.12.1

1.12.2

1.13.0

1.13.1

1.14.0

1.14.1

1.15.0

1.15.1

1.15.2

1.16.0

1.16.1

1.18.0

1.18.1

1.18.10

1.18.11

1.18.12

1.18.13

1.18.14

1.18.15

1.18.16

1.18.17

1.18.18

1.18.19

1.18.2

1.18.20

1.18.3

1.18.4

1.18.5

1.18.6

1.18.7

1.18.8

1.18.9

1.2.0

1.2.1

1.3.0

1.3.1

1.4.0

1.5.0

1.6.0

1.7.0

2.*

2.0.0

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.2.0

2.2.1

2.260520.0

2.260525.0

2.260527.0

2.260529.0

2.260601.0

2.260603.0

2.260603.1

2.260604.0

2.260612.0

2.260615.0

2.260619.0

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71854.json"