ONEARMY community-platform before version 2.165.2 contains an insecure direct object reference that allows an authenticated user to mark any other user's notifications as read by using the POST /api/notifications/:id/read endpoint. Because the endpoint lacks a proper ownership check, attackers can execute the action on arbitrary notification identifiers. This capability does not grant data read, but it alters notification state, enabling the attacker to suppress notification badges and prevent users in the same tenant from seeing replies, comments, and new content.

Authenticated customers running ONEARMY community-platform versions earlier than 2.165.2 are vulnerable. The issue was present in the 2.163.2 release and all earlier builds that did not incorporate the fix included in v2.165.2. The vulnerability affects the notification management component exposed through the API.

The CVSS score of 5.3 indicates moderate severity. The metric does not include a specific attack vector, but the absence of an EPSS score and the lack of KEV listing suggest that exploitation has not yet been widely observed. The vulnerability requires the attacker to be authenticated within a tenant and relies on enumeration of numeric notification identifiers. Successful exploitation results in preventing other users from receiving notification alerts; however, it does not grant direct access to personal data or system control.