VULNERABILITY INTELLIGENCE
CVE-2026-116018
CVSS score4.3 MEDIUM
EPSS probability0.21%
CISA KEVNot currently listed
Published2026-10-24
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.
Weakness classification
- disclosure@vulncheck.com: CWE-639