{"id":"CVE-2026-125379","kind":"vulnerability","aliases":["CVE-2026-125379"],"related":[],"title":"Movim: authenticated users can read restricted posts from cache","description":"Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide cache before the XMPP authorization check runs.","summary":"Movim, a self-hosted XMPP social network, has an authorization bypass in its Post::ajaxGetPost handler through version 0.35.5. An authenticated user who knows item identifiers can read community or contact-only posts from the pod-wide cache before the access check runs.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"movim","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["movim","other","self-hosted","xmpp"],"not_affected_if":["no-untrusted-accounts"],"how_to_check":"- Check the installed Movim version against the fixed release in the sources (unknown if not stated)\n- Confirm whether the pod runs a Movim version through `0.35.5`","fix":null,"status":"open","published_at":"2026-11-10T00:17:10+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","triaged_at":"2026-11-10T00:30:41+00:00","updated_at":"2026-11-10T00:30:41+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:30:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Movim: authenticated users can read restricted posts from cache","impact":"low","summary":"Movim, a self-hosted XMPP social network, has an authorization bypass in its Post::ajaxGetPost handler through version 0.35.5. An authenticated user who knows item identifiers can read community or contact-only posts from the pod-wide cache before the access check runs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["movim","xmpp","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated users read restricted posts they should not see","analyst_note":"Find the fixed Movim version and the patch commit from the linked GitHub fix and confirm the affected range.","how_to_check":"- Check the installed Movim version against the fixed release in the sources (unknown if not stated)\n- Confirm whether the pod runs a Movim version through `0.35.5`","plain_action":"","product_name":"movim","needs_analyst":true,"not_affected_if":["no-untrusted-accounts"],"who_is_affected":"Movim pods running version 0.35.5 or earlier are in scope, since the flaw sits in the post retrieval handler that serves cached community and contact-only posts to any logged-in user. Pods with no untrusted accounts may be lower risk. The sources do not say which configurations are unaffected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000731,"input_tokens":4608,"output_tokens":540,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125379':12A,15A '-2026':11A,14A '0.35.5':42B,71C 'access':66B 'ajaxgetpost':38B,79C 'allow':81C 'attack':95C 'authent':2A,44B,82C 'author':33B,74C,118C 'bypass':34B,75C 'cach':9A,63B,102C,114C 'check':67B,119C 'communiti':52B,103C 'contact':55B,106C 'contact-on':54B,105C 'contain':72C 'cve':10A,13A 'handler':39B 'host':21B,27B 'identifi':49B,99C 'item':48B,98C 'know':47B,97C 'movim':1A,16A,17B,23B,69C 'network':30B 'node':91C 'nodeid':93C 'pod':61B,112C 'pod-wid':60B,111C 'post':7A,37B,57B,78C,87C,108C 'read':5A,51B,85C 'restrict':6A,86C 'retriev':101C 'run':68B,120C 'self':20B,26B 'self-host':19B,25B 'server':90C 'social':29B 'suppli':89C 'user':3A,45B,83C 'valu':94C 'version':41B 'vulner':76C 'wide':62B,113C 'xmpp':22B,28B,117C","nicknames":[],"mitigations":[],"who_affected":"Movim pods running version 0.35.5 or earlier are in scope, since the flaw sits in the post retrieval handler that serves cached community and contact-only posts to any logged-in user. Pods with no untrusted accounts may be lower risk. The sources do not say which configurations are unaffected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["movim"],"ptokens":["movim"],"labels":["low","movim","other","selfhosted","vendor","xmpp"],"campaign_type":null,"search_a":"'-125379':12A,15A '-2026':11A,14A 'authent':2A 'cach':9A 'cve':10A,13A 'movim':1A,16A 'post':7A 'read':5A 'restrict':6A 'user':3A","search_b":"'0.35.5':42B 'access':66B 'ajaxgetpost':38B 'authent':44B 'author':33B 'bypass':34B 'cach':63B 'check':67B 'communiti':52B 'contact':55B 'contact-on':54B 'handler':39B 'host':21B,27B 'identifi':49B 'item':48B 'know':47B 'movim':17B,23B 'network':30B 'pod':61B 'pod-wid':60B 'post':37B,57B 'read':51B 'run':68B 'self':20B,26B 'self-host':19B,25B 'social':29B 'user':45B 'version':41B 'wide':62B 'xmpp':22B,28B","search_c":"'0.35.5':71C 'ajaxgetpost':79C 'allow':81C 'attack':95C 'authent':82C 'author':74C,118C 'bypass':75C 'cach':102C,114C 'check':119C 'communiti':103C 'contact':106C 'contact-on':105C 'contain':72C 'identifi':99C 'item':98C 'know':97C 'movim':69C 'node':91C 'nodeid':93C 'pod':112C 'pod-wid':111C 'post':78C,87C,108C 'read':85C 'restrict':86C 'retriev':101C 'run':120C 'server':90C 'suppli':89C 'user':83C 'valu':94C 'vulner':76C 'wide':113C 'xmpp':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125379","severity":null,"published_at":"2026-11-10T00:17:10+00:00","modified_at":"2026-11-10T00:17:10+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","fetched_at":"2026-11-10T00:28:43+00:00","note":null}],"documents":[{"id":111541,"url":"https://github.com/movim/movim/commit/378e0368368d0dd9cb090b78e68a63064d47d512","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111542,"url":"https://www.vulncheck.com/advisories/movim-through-0.35.5-authorization-bypass-via-post-ajaxgetpost-cached-post-read","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}