{"id":"CVE-2026-111722","kind":"vulnerability","aliases":["CVE-2026-111722"],"related":[],"title":"LingGuo-Drama: registered users can read, change or delete other users' projects","description":"LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.","summary":"LingGuo-Drama through commit 8a6924a lets any self-registered user call the project endpoints with numeric IDs and skip the owner check. An attacker can read, overwrite, reassign or delete other users' short-drama projects.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lingguo-drama","other","self-hosted"],"not_affected_if":["registration-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:56+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:00:03+00:00","updated_at":"2026-10-25T03:00:03+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:00:03Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"LingGuo-Drama: registered users can read, change or delete other users' projects","impact":"high","summary":"LingGuo-Drama through commit 8a6924a lets any self-registered user call the project endpoints with numeric IDs and skip the owner check. An attacker can read, overwrite, reassign or delete other users' short-drama projects.","category":"other","nicknames":[],"who_cares":["self-hosted","lingguo-drama"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads, alters or deletes every user's projects","analyst_note":"Find the upstream fix commit or patched release for LingGuo-Drama after 8a6924a and confirm the owner check added to projects.Get; check the NVD entry for the CVSS vector.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["registration-disabled"],"who_is_affected":"Deployments of LingGuo-Drama at or before commit 8a6924a where open self-registration is enabled, since any new account can reach the project endpoints. The sources do not say which deployments or versions are patched. Installations with registration closed to outsiders, or without this codebase, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000565,"input_tokens":3344,"output_tokens":461,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111722':16A,19A '-2026':15A,18A '/admin/v1/projects':106C '8a6924a':32B,70C 'access':83C 'allow':79C 'attack':52B,96C 'call':39B 'chang':8A 'check':50B,92C 'commit':31B,69C 'contain':71C 'cve':14A,17A 'delet':10A,58B,105C,113C 'direct':74C 'drama':3A,22B,29B,63B,67C,119C 'endpoint':42B 'get':102C 'host':26B 'id':45B,100C,107C 'insecur':73C 'iter':98C 'lack':89C 'let':33B 'lingguo':2A,21B,28B,66C 'lingguo-drama':1A,20B,27B,65C 'numer':44B,99C 'object':75C 'overwrit':55B,110C 'owner':49B,91C 'project':13A,41B,64B,86C,120C 'projects.get':88C 'put':103C 'read':7A,54B,109C 'reassign':56B,111C 'refer':76C 'regist':4A,37B,80C,95C 'self':25B,36B,94C 'self-host':24B 'self-regist':35B,93C 'short':62B,118C 'short-drama':61B,117C 'skip':47B 'user':5A,12A,38B,60B,81C,85C,115C 'via':101C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Deployments of LingGuo-Drama at or before commit 8a6924a where open self-registration is enabled, since any new account can reach the project endpoints. The sources do not say which deployments or versions are patched. Installations with registration closed to outsiders, or without this codebase, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111722","severity":null,"published_at":"2026-10-16T18:17:56+00:00","modified_at":"2026-10-16T19:17:05+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}