Movim through 0.35.5 contains an authorization bypass in the Post::ajaxGetPost function that lets an authenticated user read posts that should be restricted. By supplying the server, node and nodeid parameters, an attacker can retrieve cached community or contact-only posts from the pod-wide cache before the normal XMPP authorization validation occurs. The effect is limited to disclosure of posts, not execution of code or modification of data.

The vulnerability affects the Movim platform, version 0.35.5 and earlier. External references show the issue in the source code of the Post widget. No other product versions are known to be vulnerable.

The CVSS score of 2.3 indicates low severity and the EPSS score is not available, so exploitation likelihood is not quantified. The exploit requires an authenticated user who knows the identifiers of the target post and the ability to send an AJAX request to the Post::ajaxGetPost endpoint. Because the vulnerability allows reading of cached posts before authorization, it is an example of the CWE-639 weakness. The vulnerability is not currently listed in CISA KEV.