Description
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.
Published: 2026-08-11
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The OpenIM Server v3.8.3 code omits an authorization check on several admin‑only endpoints. Any authenticated user can send POST requests to /user/get_users, /user/get_all_users_uid, and /group/get_groups and retrieve the full list of platform users and private groups, including user IDs, nicknames, manager flags, group names, owner IDs, and member counts. The flaw is a classic missing authorization (CWE‑862) that allows an attacker to enumerate sensitive platform data without elevated privileges.

Affected Systems

The vulnerability affects OpenIMSDK’s OpenIM Server version 3.8.3, as identified in the repository and issue tracker links. Only this specific release is documented; no other versions are listed as affected.

Risk and Exploitability

The CVSS vector scores 7.1, indicating substantial impact. The EPSS score is below 1%, suggesting the probability of exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers still require only a valid user token, implying that any authenticated user can exploit this flaw. Consequently, the risk is moderate to high when authentication is widespread, especially on systems that expose these endpoints to regular users.

Generated by OpenCVE AI on August 12, 2026 at 20:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the patched release of OpenIM Server (or the latest version that incorporates the commit adding authverify.CheckAdmin() to the affected handlers.
  • If an upgrade is not immediately feasible, apply the upstream patch commit (e.g., 193870b2f938278b27a2d8347bd7e4db5f8f9dfc) to insert the missing authorization check into GetPaginationUsers, GetAllUserID, and GetGroups handlers.
  • Restrict access to the vulnerable endpoints for non‑administrator tokens by configuring a reverse proxy or firewall rule to block or rate‑limit requests from unauthenticated or non‑admin sources.
  • Continuously monitor service logs for anomalous enumeration activity and enforce strict auditing of user token usage.

Generated by OpenCVE AI on August 12, 2026 at 20:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Openimsdk
Openimsdk openim Server (open-im-server)
Vendors & Products Openimsdk
Openimsdk openim Server (open-im-server)

Tue, 11 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Description OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.
Title OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Openimsdk Openim Server (open-im-server)
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-11T20:03:05.306Z

Reserved: 2026-08-03T13:26:21.234Z

Link: CVE-2026-69115

cve-icon Vulnrichment

Updated: 2026-08-11T20:02:59.955Z

cve-icon NVD

Status : Received

Published: 2026-08-11T19:18:42.093

Modified: 2026-08-11T20:18:41.310

Link: CVE-2026-69115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:49:43Z

Weaknesses