A vulnerability exists where an authenticated user can change another user's profile picture. This insecure direct object reference allows an attacker to replace or tamper with the profile image of any account they have access to, potentially defacing the user or conveying misleading information. The flaw does not expose sensitive data, but it violates data integrity and could undermine user trust.

Askbot, version 0.12.2 and any earlier releases, running on Linux, macOS, or Windows. The issue specifically affects the 0.12.2 build cited in the advisory.

The CVSS score of 5.3 indicates a moderate impact. EPSS is less than 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must be authenticated as a normal user and can exploit the flaw by submitting a request to update another user's avatar, implicitly referencing that user's object ID. The attack vector is through the web interface and requires no special privileges beyond those of a regular account.