Live › vulnerability › CVE-2026-66091
Go to dashboardIn openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint has no authentication or authorisation check. An unauthenticated attacker who knows another user's uniqueId can read that user's username, first name, last name and email address.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Any institution running openEQUELLA before that exposes its API to the network where the endpoint is reachable is exposed, since the endpoint needs no login. Installations where the API is reachable only from a trusted internal network are at lower risk. Teams on or later can skip it.
2026.12026.1No product ranges from the sources yet.
2026.1 are affected.GET /api/userquery/userinfobackup answers without a session token, for example curl -i https://<host>/api/userquery/userinfobackup?uniqueId=<known-id>.2026.1 or later./api/userquery/userinfobackup at the reverse proxy or load balancer.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
This page as .md · .json · in your agent: get_signal("CVE-2026-66091")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.