Executive Summary

CVE-2026-24773 is an Insecure Direct Object Reference (IDOR) vulnerability in the Open eClass platform versions up to 4.1. It allows unauthenticated remote attackers to access personal files of other users by manipulating predictable, sequential user identifiers in the URL. Specifically, attackers can send HTTP GET requests with different user IDs and file names to retrieve files belonging to other users without any authentication or authorization checks.

The vulnerability exists because the system does not properly verify whether the requester is authorized to access the requested files, leading to unauthorized disclosure of sensitive user data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive personal files belonging to other users. Since no authentication is required, any remote attacker can exploit this flaw to access private data simply by guessing or enumerating user IDs and requesting files directly.

The impact includes exposure of confidential information, which can result in privacy violations, loss of trust, and potential misuse of the exposed data.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access files of other users through unauthenticated HTTP GET requests that manipulate the user ID in the URL. Since user IDs are sequential and predictable, you can try enumerating user IDs to see if files from other users are accessible.'}, {'type': 'paragraph', 'content': 'A suggested command to test this vulnerability is to send an HTTP GET request to the affected endpoint with different user IDs, for example:'}, {'type': 'list_item', 'content': 'curl -i "http://<target>/modules/document/file.php/user,14/personal_file.txt"'}, {'type': 'paragraph', 'content': "Replace '14' with other user IDs to check if files belonging to other users can be accessed without authentication."}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the Open eClass platform to version 4.2 or later, where this issue has been patched.

Until the upgrade can be performed, restrict access to the vulnerable endpoint by implementing access controls or network-level restrictions to prevent unauthenticated access to the file access URL.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated remote attackers to access personal files of other users, leading to unauthorized disclosure of potentially sensitive user data.

Such unauthorized exposure of personal data can result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls to protect personal and sensitive information from unauthorized access.

Useful 0 Not Useful 0