The AdminRoleHandler GET endpoint in Oppia’s core/controllers/admin is marked with open_access, letting any registered user query privileged account information. Users can supply filter_criterion parameters to extract usernames that hold specified roles, see whether accounts are banned, and discover which topics are managed by those accounts. This enables an attacker to enumerate privileged accounts without any authentication beyond registration, exposing sensitive internal identities and role assignments that could facilitate further exploitation.

Oppia, version 3.5.2 and any earlier releases that have not applied the fix. The vulnerability is specific to the AdminRoleHandler GET endpoint in the core/admin.py module.

The CVSS score of 5.3 indicates a medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires only that the attacker is a registered user, which is common, so the likelihood of exploitation is moderate. Attackers can remotely enumerate privileged accounts by sending standard GET requests to the endpoint; no privileged privileges or additional access tokens are needed.