Description
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
Published: 2026-10-16
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access and modification of other users' projects
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an insecure direct object reference that allows a registered user to discover, read, overwrite, reassign or delete any other user's short‑drama project by manipulating the numeric project identifier in /admin/v1/projects/:id. The impact includes loss of confidentiality, integrity, and availability of user projects, potentially exposing sensitive information or damaging user data.

Affected Systems

This issue is present in LingGuo-Drama, a product of LingGuoAI. The affected versions include all releases up to and including the commit 8a6924a where projects.Get lacked an owner check. The exact version name is not specified, but the vulnerability exists in any release that incorporates the code path shown in the referenced GitHub commit.

Risk and Exploitability

The CVSS score of 8.6 indicates critical severity. No EPSS score is available, but the absence of an owner guard allows any registered user to enumerate numeric IDs for GET, PUT or DELETE of /admin/v1/projects/:id, making the exploit trivial for an authenticated attacker. Because the vulnerability is not listed in the CISA KEV catalog, it is likely not currently targeted by known exploits, yet the high CVSS rating and straightforward enumeration path keep exploitation probability significant for any attacker who has valid credentials.

Generated by OpenCVE AI on October 16, 2026 at 19:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade LingGuo-Drama to the latest release that adds an owner check to the projects.Get endpoint or apply the community patch that implements this guard
  • If upgrading is not yet possible, modify the server code locally to enforce an owner check before allowing GET, PUT, or DELETE on /admin/v1/projects/:id
  • Restrict the /admin/v1/projects/:id API to administrative users only, or disable the endpoint for non‑admin accounts, until a proper fix is in place

Generated by OpenCVE AI on October 16, 2026 at 19:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
Title LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T18:17:12.430Z

Reserved: 2026-10-16T14:33:31.226Z

Link: CVE-2026-111722

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:56.823

Modified: 2026-10-16T19:17:05.570

Link: CVE-2026-111722

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T19:45:14Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key