Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference that permits an authenticated user to access any private message attachment by requesting the /messages/attachment/{guid} route with a guessed or sequentially derived file GUID. This enables a user to read attachments from conversations where they are neither the sender nor the recipient, breaching confidentiality of private communications and abusing the application’s authorization controls. The weakness is classified as CWE‑639, a typical IDOR flaw.

This vulnerability affects the OSSN Open Source Social Network application up to and including version 10.1. All installations that have not applied any fixes or upgraded beyond 10.1 are vulnerable. The affected product is identified by the vendor opensource-socialnetwork in the CPE namespace.

The CVSS score of 7.1 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation at the time of analysis. Attackers must first authenticate to the site and then guess or enumerate GUIDs to retrieve attachments. The path is straightforward: a legitimate user crafts a request to /messages/attachment/{guid}; if the GUID belongs to an attachment they are not authorized for, the server still returns the file because no sender/recipient checks are performed. Thus the exploit is local to the authenticated user context and does not require additional privileges or network-level access.