Live › vulnerability › CVE-2026-111722
Go to dashboardLingGuo-Drama through commit 8a6924a lets any self-registered user call the project endpoints with numeric IDs and skip the owner check. An attacker can read, overwrite, reassign or delete other users' short-drama projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of LingGuo-Drama at or before commit 8a6924a where open self-registration is enabled, since any new account can reach the project endpoints. The sources do not say which deployments or versions are patched. Installations with registration closed to outsiders, or without this codebase, are not affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
This page as .md · .json · in your agent: get_signal("CVE-2026-111722")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.