{"id":"CVE-2026-82411","kind":"vulnerability","aliases":["CVE-2026-82411"],"related":[],"title":"Open Object: scoped API token reads other object types' history records","description":"Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint `GET /api/v2/objects/{uuid}/{index}`. The `history_detail` action in `src/objects/api/v2/views.py` calls `self.get_queryset()` and `get_object_or_404` directly instead of `self.get_object()`, so `check_object_permissions` and the per-object check in `ObjectTypeBasedPermission.has_object_permission` are not invoked. The queryset's `filter_for_token` applies only to the list and search actions, while `ObjectTypeBasedPermission.has_permission` allows non-create actions, leaving neither check to constrain history-detail records to the token's permitted ObjectType. The normal retrieve endpoint returns 403 for the same unauthorized object, and the sibling history action enforces the grant. Any valid non-superuser API token with a read grant on at least one ObjectType can therefore disclose another ObjectType's complete versioned object `data`, which can include citizen or case records and sensitive identifiers in government deployments. This issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.","summary":"A valid API token with read access to one ObjectType can fetch the full versioned record of objects belonging to other ObjectTypes through the history-detail endpoint. The authorization checks that the normal retrieve endpoint applies are skipped on that path, so the record data, which can include sensitive personal or case records, is disclosed.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","government","open-object","package","self-hosted"],"not_affected_if":["patched-version","superuser-tokens-only"],"how_to_check":"- Check the installed Open Object version against the affected ranges: 2.4.3 through 2.5.0, 3.x before 3.6.2, 4.0.0 through 4.0.1, and 4.1.0.\n- Look for a route `GET /api/v2/objects/{uuid}/{index}` that is reachable with non-superuser API tokens.","fix":"- Upgrade Open Object to `2.5.1`, `3.6.2`, `4.0.2`, or `4.1.1` depending on the release line in use.\n- Review API tokens that have read grants on any ObjectType, since any of them could have exposed other types' history records.","status":"open","published_at":"2026-10-28T23:17:10+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","triaged_at":"2026-10-28T23:36:39+00:00","updated_at":"2026-10-28T23:36:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T23:36:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Open Object to `2.5.1`, `3.6.2`, `4.0.2`, or `4.1.1` depending on the release line in use.\n- Review API tokens that have read grants on any ObjectType, since any of them could have exposed other types' history records.","reach":"network","title":"Open Object: scoped API token reads other object types' history records","impact":"medium","summary":"A valid API token with read access to one ObjectType can fetch the full versioned record of objects belonging to other ObjectTypes through the history-detail endpoint. The authorization checks that the normal retrieve endpoint applies are skipped on that path, so the record data, which can include sensitive personal or case records, is disclosed.","category":"package","nicknames":[],"who_cares":["open-object","api","self-hosted","government"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reads other ObjectTypes' full versioned records, including sensitive identifiers.","analyst_note":"","how_to_check":"- Check the installed Open Object version against the affected ranges: 2.4.3 through 2.5.0, 3.x before 3.6.2, 4.0.0 through 4.0.1, and 4.1.0.\n- Look for a route `GET /api/v2/objects/{uuid}/{index}` that is reachable with non-superuser API tokens.","needs_analyst":false,"not_affected_if":["patched-version","superuser-tokens-only"],"who_is_affected":"Deployments of Open Object from 2.4.3 up to the fixed releases that issue non-superuser API tokens with a read grant on at least one ObjectType. Government or case-management deployments holding citizen or sensitive records are the highest-risk setups. Instances on the fixed versions, or where only superuser tokens exist, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":3664,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-82411':14A,17A '/api/v2/objects':132C '2.4.3':98C '2.5.1':100C,272C '3.6.2':101C,273C '4.0.2':102C,274C '4.1.1':104C,276C '403':213C '404':148C 'access':33B 'action':138C,184C,192C,223C 'admin':89C 'allow':188C 'anoth':246C 'api':4A,18B,29B,87C,232C 'appli':63B,177C 'author':56B 'belong':45B 'call':141C 'case':79B,258C 'check':57B,155C,163C,195C 'citizen':256C 'complet':249C 'constrain':197C 'creat':191C 'cve':12A,15A 'data':72B,252C 'deploy':265C 'detail':53B,129C,137C,200C 'direct':149C 'disclos':82B,245C 'endpoint':54B,62B,130C,211C 'enforc':224C 'fetch':38B 'filter':174C 'fix':269C 'full':40B,115C 'get':131C,145C 'govern':19B,264C 'grant':226C,237C 'histori':10A,52B,128C,136C,199C,222C 'history-detail':51B,127C,198C 'host':26B 'identifi':262C 'includ':75B,255C 'index':134C 'instead':150C 'interfac':90C 'invok':170C 'issu':267C 'least':240C 'leav':193C 'list':181C 'manag':92C 'neither':194C 'non':190C,230C 'non-creat':189C 'non-superus':229C 'normal':60B,209C 'object':2A,8A,22B,44B,84C,93C,95C,120C,146C,153C,156C,162C,166C,218C,251C 'objecttyp':36B,48B,111C,124C,207C,242C,247C 'objecttypebasedpermission.has':165C,186C 'one':35B,110C,241C 'open':1A,21B,83C 'open-object':20B 'packag':23B 'path':68B 'per':161C 'per-object':160C 'permiss':157C,167C,187C 'permit':206C 'person':77B 'provid':85C 'queryset':143C,172C 'read':6A,32B,109C,113C,236C 'record':11A,42B,71B,80B,117C,201C,259C 'retriev':61B,210C 'return':212C 'scope':3A,107C 'search':183C 'self':25B 'self-host':24B 'self.get':142C,152C 'sensit':76B,261C 'sibl':221C 'skip':65B 'src/objects/api/v2/views.py':140C 'superus':231C 'therefor':244C 'token':5A,30B,106C,176C,204C,233C 'type':9A,96C 'unauthor':217C 'uuid':133C 'valid':28B,228C 'version':41B,116C,250C,271C 'via':125C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Open Object from 2.4.3 up to the fixed releases that issue non-superuser API tokens with a read grant on at least one ObjectType. Government or case-management deployments holding citizen or sensitive records are the highest-risk setups. Instances on the fixed versions, or where only superuser tokens exist, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T23:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82411","severity":null,"published_at":"2026-10-28T23:17:10+00:00","modified_at":"2026-10-28T23:17:10+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","fetched_at":"2026-10-28T23:35:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}