Description
A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument file_id can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-31
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in caoqianming's django-vue-admin 1.0 allows manipulation of file_id to bypass intended access controls. This flaw is an example of CWE-266 (Privilege Escalation) and CWE-284 (Improper Access Control). An attacker can craft a file_id value and retrieve protected files via a remote HTTP request, compromising confidentiality of data stored in the application.

Affected Systems

The vulnerability affects installations of caoqianming django-vue-admin version 1.0 and any upgrades that keep the same /api/file/ endpoint logic, as indicated by the CPE entry. The vendor has not yet issued a fix, so the flaw is present across all deployments exposing the endpoint.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the issue is not listed in CISA KEV. The attack can be executed remotely by supplying a crafted file_id, so the risk remains significant until mitigated. The lack of an official patch means the attack surface persists until hardening measures are implemented.

Generated by OpenCVE AI on August 31, 2026 at 20:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Perform an immediate code review of the /api/file/ handler to ensure proper ownership verification before serving files.
  • Restrict the /api/file/ endpoint to authenticated users and enforce file ownership checks before accessing files.
  • Sanitize the file_id parameter to prevent arbitrary file access or directory traversal attacks.
  • If the /api/file/ endpoint is not required, disable or remove it from the application.
  • When an updated version becomes available, upgrade promptly to eliminate the vulnerability.

Generated by OpenCVE AI on August 31, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument file_id can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title caoqianming django-vue-admin file access control
First Time appeared Caoqianming
Caoqianming django-vue-admin
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:caoqianming:django-vue-admin:*:*:*:*:*:*:*:*
Vendors & Products Caoqianming
Caoqianming django-vue-admin
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Caoqianming Django-vue-admin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T19:30:08.728Z

Reserved: 2026-08-31T07:30:13.901Z

Link: CVE-2026-82835

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-31T20:17:15.673

Modified: 2026-08-31T20:56:08.800

Link: CVE-2026-82835

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:20:11Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control