CVE-2026-71854

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71854
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71854.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71854
Aliases
  • GHSA-47wr-wp4h-8v3f
Published
2026-10-14T20:05:05Z
Modified
2026-10-15T10:48:12Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
OpenAEV has unauthenticated access and missing object-level authorization on player lessons API
Details

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/** lessons endpoints can be called without authentication, and they trust a client-supplied userId query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-306",
        "CWE-639",
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71854.json"
}
References

Affected packages

Git / github.com/openaev-platform/openaev

Affected ranges

Type
GIT
Repo
https://github.com/openaev-platform/openaev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6fa23d70a808cb3c5a38da63b95577a3eb10ca41
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.260622.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.1.1
1.10.0
1.12.0
1.12.1
1.12.2
1.13.0
1.13.1
1.14.0
1.14.1
1.15.0
1.15.1
1.15.2
1.16.0
1.16.1
1.18.0
1.18.1
1.18.10
1.18.11
1.18.12
1.18.13
1.18.14
1.18.15
1.18.16
1.18.17
1.18.18
1.18.19
1.18.2
1.18.20
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.18.9
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
1.5.0
1.6.0
1.7.0
2.*
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.2.0
2.2.1
2.260520.0
2.260525.0
2.260527.0
2.260529.0
2.260601.0
2.260603.0
2.260603.1
2.260604.0
2.260612.0
2.260615.0
2.260619.0
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71854.json"