CVE-2026-111722

HighCVSS 8.1

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Summary

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.

Risk Assessment

A registered attacker can read, modify, or delete projects belonging to other users, violating data confidentiality and integrity.

Recommendation

Add an owner check in projects.Get and update LingGuo-Drama to a version containing the fix.

Other vulnerabilities in LingGuo-Drama

CVE-2026-111723High
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password, raise their authority_id, and delete accounts.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS