CVE-2026-54050
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Sakai versions from 23.0 to 23.5 and 25.3 have a vulnerability where an authenticated user can delete another user's profile image via the DELETE /api/users/{userId}/profile/image endpoint, because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership. Similarly, the DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before deleting the target user's recording.
Risk Assessment
An attacker can repeatedly remove profile identity artifacts, including administrator and instructor images, potentially disrupting workflows that rely on those artifacts.
Recommendation
It is recommended to upgrade Sakai to versions 23.5, 25.3, or 26.0, which include the fix.
Other vulnerabilities in Sakai
See all- CVE-2026-54049High
In Sakai (CLE) from versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.
- CVE-2025-62710Medium
Sakai, a Collaboration and Learning Environment, prior to versions 23.5 and 25.0, initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non-cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at-rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.
Original NVD description (English source)
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS