VULNERABILITY INTELLIGENCE
CVE-2024-55186
CVSS score4.3 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2024-12-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-639