---
id: "CVE-2026-66091"
kind: "vulnerability"
aliases: ["CVE-2026-66091"]
title: "openEQUELLA: unauthenticated endpoint leaks other users' names and emails"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["education", "openequella", "other", "self-hosted"]
not_affected_if: ["api-not-exposed", "patched-version"]
published_at: "2026-10-29T02:16:52+00:00"
first_seen_at: "2026-10-29T02:36:48+00:00"
updated_at: "2026-10-29T02:38:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66091", "first_seen_at": "2026-10-29T02:36:48+00:00"}]
---

# openEQUELLA: unauthenticated endpoint leaks other users' names and emails

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint has no authentication or authorisation check. An unauthenticated attacker who knows another user's uniqueId can read that user's username, first name, last name and email address.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the openEQUELLA version in use; releases before `2026.1` are affected.
- Test whether `GET /api/userquery/userinfobackup` answers without a session token, for example `curl -i https://<host>/api/userquery/userinfobackup?uniqueId=<known-id>`.

## Fix

- Upgrade openEQUELLA to `2026.1` or later.
- Until upgraded, block or restrict access to `/api/userquery/userinfobackup` at the reverse proxy or load balancer.

## Timeline

- 2026-10-29T02:36:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66091

## From the sources

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_