CVE-2026-111343
MediumCVSS 4.3Summary
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
Risk Assessment
Authenticated users can access other users' personal data, leading to confidentiality breaches and potential use in social engineering attacks.
Recommendation
Update pig to a version later than 4.1.1 if available, or implement authorization checks in SysUserController.user.
Other vulnerabilities in pig
Original NVD description (English source)
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS