CVE-2026-111722
Deferred Deferred - Pending Action

Insecure Direct Object Reference in LingGuo-Drama

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111722
EUVD
EUVD-2026-103014

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LingGuoAI LingGuo-Drama 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LingGuo-Drama has an insecure direct object reference vulnerability where registered users can access other users' projects without proper authorization checks. The endpoint projects.Get does not verify ownership, allowing attackers to manipulate project IDs via GET, PUT, or DELETE requests to read, modify, or delete any user's short-drama projects.

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized GET, PUT, or DELETE requests to /admin/v1/projects/:id endpoints. Check application logs for repeated access attempts with varying numeric IDs. Verify if projects.Get lacks owner validation in the codebase.

Impact Analysis

If you use LingGuo-Drama, an attacker could access, alter, or delete your projects without permission. This could lead to data loss, unauthorized changes, or exposure of sensitive content. The impact depends on the nature of your projects and their importance.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data or HIPAA by compromising protected health information if projects contain such data. Unauthorized access risks non-compliance with data protection requirements, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Immediately restrict access to /admin/v1/projects/:id endpoints to authorized users only. Implement strict input validation to ensure users can only access their own projects. Update the projects.Get function to include owner checks before granting access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart