Sakai is a Collaboration and Learning Environment that includes a RESTful API for managing user profile data. From versions 23.0 through 23.5 and 25.3, an authenticated user may send a DELETE request to /api/users/{userId}/profile/image. Because ProfileController.removeProfileImage() forwards the supplied userId directly to ProfileServiceImpl.removeProfileImage() without verifying that the requester owns the target profile, and because profileImageUploadedRepository.deleteById(userId) then deletes the record, the application allows an attacker to delete another user’s profile image. The same flaw exists for the pronunciation recording endpoint at /api/users/{userId}/profile/pronunciation, which also lacks ownership checks before executing the delete. Uploading new images is not affected, as that action already validates ownership, and superusers are intentionally allowed to modify any profile. An attacker can repeatedly delete profile identity artifacts, such as administrator and instructor photos, thereby disrupting workflows that rely on those fixed in the 23.5, 25.3, and 26.0 releases.

Sakai Collaboration and Learning Environment (CLE) versions 23.0 through 23.5 and 25.3 are affected. Versions 26.0 and newer contain the fix.

The CVSS score of 6.5 indicates a moderate severity risk. EPSS of <1% shows a very low probability that this vulnerability is currently being exploited. This issue is notV catalog. The attack vector is internal, requiring legitimate DELETE request with another user’s identifier to trigger deletion. Because superusers are deliberately permitted to modify any profile, the flaw does not compromise system‑wide integrity beyond the target user’s profile image. The principal impact is the loss of user identity artifacts and the disruption of administrative or instructional workflows, rather than a critical system compromise.