Live › vulnerability › CVE-2026-116018
Go to dashboardONEARMY community-platform before 2.165.2 lets any logged-in user call POST /api/notifications/:id/read on notification IDs that belong to other users. An attacker can iterate sequential IDs to silently clear other users' unread notifications, so they miss replies and comments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Teams running ONEARMY community-platform before 2.165.2 with multiple user accounts in one tenant. The flaw needs only a regular authenticated account, so any deployment with open or self-service sign-up is exposed. Single-user deployments and anyone already on 2.165.2 or later can skip it.
No product ranges from the sources yet.
2.165.2.POST /api/notifications/:id/read verifies that the notification belongs to the requesting user.2.165.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.
This page as .md · .json · in your agent: get_signal("CVE-2026-116018")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.