Live › vulnerability › CVE-2026-111649
Go to dashboardPaopao-ce through 0.6.0-alpha.3 lets any logged-in user request attachments by arbitrary content ID through the /v1/attachment endpoint. An attacker can enumerate sequential IDs and get signed download URLs for other users' private, friend-only and following-only images, videos and files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted paopao-ce instances at version 0.6.0-alpha.3 or earlier that store private, friend-only or following-only media are exposed to any authenticated user. Instances with no private content or with registration closed to trusted users have less exposure. Deployments already on a later release that fixes the object reference check can skip this.
No product ranges from the sources yet.
unknown whether the sources name the exact file or line to inspect/v1/attachment is reachable on your deployment with a normal user account0.6.0-alpha.3; unknown which release contains the patch/v1/attachment route for non-owners if possibleEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.
This page as .md · .json · in your agent: get_signal("CVE-2026-111649")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.