Openwhyd before version 1.65.1 allows attackers without authentication to inject NoSQL operators into the 'id' field of the POST /api/user endpoint. By sending JSON objects containing MongoDB query operators such as $ne or $gt, an adversary can alter the query used to locate a user record, permitting enumeration of other users' public profile data that is not otherwise accessible.

The vulnerability affects the openwhyd product from the openwhyd vendor, specifically all releases prior to version 1.65.1. Any instance exposing the /api/user endpoint is vulnerable and can be targeted by external actors.

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available, so exploit probability cannot be quantified. The issue is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Attackers can reach the vulnerable endpoint via any route that allows HTTP POST requests, often from the public internet, and the lack of authentication means the attack can be performed by anyone who can reach the API, making exploitation relatively straightforward.