{"id":"CVE-2026-66091","kind":"vulnerability","aliases":["CVE-2026-66091"],"related":[],"title":"openEQUELLA: unauthenticated endpoint leaks other users' names and emails","description":"In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.","summary":"In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint has no authentication or authorisation check. An unauthenticated attacker who knows another user's uniqueId can read that user's username, first name, last name and email address.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["education","openequella","other","self-hosted"],"not_affected_if":["api-not-exposed","patched-version"],"how_to_check":"- Check the openEQUELLA version in use; releases before `2026.1` are affected.\n- Test whether `GET /api/userquery/userinfobackup` answers without a session token, for example `curl -i https://<host>/api/userquery/userinfobackup?uniqueId=<known-id>`.","fix":"- Upgrade openEQUELLA to `2026.1` or later.\n- Until upgraded, block or restrict access to `/api/userquery/userinfobackup` at the reverse proxy or load balancer.","status":"open","published_at":"2026-10-29T02:16:52+00:00","first_seen_at":"2026-10-29T02:36:48+00:00","triaged_at":"2026-10-29T02:38:00+00:00","updated_at":"2026-10-29T02:38:00+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-29T02:38:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade openEQUELLA to `2026.1` or later.\n- Until upgraded, block or restrict access to `/api/userquery/userinfobackup` at the reverse proxy or load balancer.","reach":"internet","title":"openEQUELLA: unauthenticated endpoint leaks other users' names and emails","impact":"medium","summary":"In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint has no authentication or authorisation check. An unauthenticated attacker who knows another user's uniqueId can read that user's username, first name, last name and email address.","category":"other","nicknames":[],"who_cares":["openequella","self-hosted","education"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads any user's name and email address in the institution.","analyst_note":"","how_to_check":"- Check the openEQUELLA version in use; releases before `2026.1` are affected.\n- Test whether `GET /api/userquery/userinfobackup` answers without a session token, for example `curl -i https://<host>/api/userquery/userinfobackup?uniqueId=<known-id>`.","needs_analyst":false,"not_affected_if":["patched-version","api-not-exposed"],"who_is_affected":"Any institution running openEQUELLA before `2026.1` that exposes its API to the network where the endpoint is reachable is exposed, since the endpoint needs no login. Installations where the API is reachable only from a trusted internal network are at lower risk. Teams on `2026.1` or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":3324,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-66091':12A,15A '/api/userquery/userinfobackup':28B,64C '2026.1':25B,61C 'address':57B,96C 'anoth':41B,77C 'attack':38B,74C 'authent':32B,68C 'authoris':34B,70C 'check':35B,71C 'cve':10A,13A 'detail':88C 'educ':16B 'email':9A,56B,95C 'endpoint':3A,29B,65C 'first':51B,90C 'get':27B,63C 'host':21B 'institut':100C 'know':40B 'last':53B,92C 'leak':4A 'name':7A,52B,54B,91C,93C 'openequella':1A,17B,23B,59C 'perform':66C 'person':87C 'read':46B 'retriev':82C 'self':20B 'self-host':19B 'store':86C 'suppli':76C 'unauthent':2A,37B,73C 'uniqueid':44B,80C 'user':6A,42B,48B,78C,84C 'usernam':50B,89C 'within':97C","nicknames":[],"mitigations":[],"who_affected":"Any institution running openEQUELLA before `2026.1` that exposes its API to the network where the endpoint is reachable is exposed, since the endpoint needs no login. Installations where the API is reachable only from a trusted internal network are at lower risk. Teams on `2026.1` or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T02:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66091","severity":null,"published_at":"2026-10-29T02:16:52+00:00","modified_at":"2026-10-29T02:16:52+00:00","first_seen_at":"2026-10-29T02:36:48+00:00","fetched_at":"2026-10-29T02:36:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}