CVE-2026-85210

MediumCVSS 4.3

Published: 03/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The GET AdminRoleHandler endpoint in Oppia is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.

Risk Assessment

The risk is the exposure of sensitive account and role information, which could facilitate further attacks or privilege escalation within the system.

Recommendation

It is recommended to immediately restrict access to this endpoint, requiring appropriate administrator privileges, and to implement role-based access control.

Other vulnerabilities in Oppia

CVE-2023-40021Medium
Oppia is an online learning platform that uses the equality operator to compare CSRF tokens, making it vulnerable to timing attacks. An attacker can guess the CSRF token, allowing them to perform actions on behalf of a logged-in user.

Original NVD description (English source)

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS