CVE-2026-71854

Deferred Deferred - Pending Action

Unauthenticated Access to Lessons in OpenAEV

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-71854

EUVD

EUVD-2026-101628

Affected Vendors & Products

Vendor	Product	Version / Range
OpenAEV-Platform	openaev	< 2.260622.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenAEV, an open-source platform for cyber adversary simulation. In versions before 2.260622.0, unauthenticated users can access the /api/player/** lessons endpoints without proper authentication checks. The system trusts a client-supplied userId parameter without verifying the caller's identity or membership in the exercise. This allows attackers to read sensitive lessons-learned questions and answers, including author identities, and manipulate answers by attributing them to arbitrary users.

Detection Guidance

Check OpenAEV API endpoints for unauthenticated access to /api/player/** paths. Verify if userId query parameters are trusted without validation. Inspect logs for unusual activity in lessons-learned sections.

Impact Analysis

If you use OpenAEV versions prior to 2.260622.0, an attacker could access confidential exercise data, including questions and answers from lessons-learned sessions. They could also modify or fabricate answers attributed to any user, potentially misleading participants or compromising the integrity of cybersecurity training exercises. This could lead to incorrect assessments or training outcomes.

Compliance Impact

This vulnerability allows unauthenticated access to sensitive data, including user identities and answers to lessons-learned questions. This could lead to unauthorized disclosure of personal data, violating GDPR's data protection principles and HIPAA's confidentiality requirements for protected health information.

Mitigation Strategies

Upgrade OpenAEV to version 2.260622.0 or later. Ensure authentication is enforced for all /api/player/** endpoints. Validate userId parameters against session or permissions.

Hi! I’m here to help you understand CVE-2026-71854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70