Executive Summary

CVE-2026-32097 is a high-severity improper access control vulnerability in the PingPong Server (versions up to 7.27.1) affecting thread file endpoints.

Authenticated users with permission to view at least one thread can exploit this flaw to retrieve files outside their authorized scope, including private user-uploaded files and model-generated output files.

Additionally, users with permission to participate in at least one thread can delete files beyond their intended scope.

The vulnerability arises from insufficient authorization checks, allowing unauthorized access or deletion by manipulating thread file endpoints.

This issue was fixed in version 7.27.2 by implementing improved validation and stricter message-scoped access controls.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized retrieval or deletion of private files, including user-uploaded files and model-generated output files.

An attacker who is an authenticated user with minimal thread permissions can access or delete files outside their intended authorization scope.

The impact includes high confidentiality and integrity risks due to unauthorized file access and deletion.

There is no impact on availability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper access control on thread file endpoints in PingPong Server versions up to 7.27.1, allowing authenticated users with minimal thread permissions to retrieve or delete files outside their authorization scope.

Detection would involve monitoring or testing access to thread file download, image download, and file deletion endpoints to verify if unauthorized retrieval or deletion is possible.

No specific detection commands or automated detection tools are provided in the available information.

A practical approach could be to attempt authenticated requests to these endpoints with a user account having minimal thread permissions and observe if files outside the authorized scope can be accessed or deleted.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the PingPong Server to version 7.27.2 or later, where the vulnerability has been fixed by implementing improved validation and stricter message-scoped access controls.

If upgrading immediately is not possible, restrict access to the thread file download, image download, and file deletion endpoints to prevent exploitation.

No other workarounds are known according to the available information.

Useful 0 Not Useful 0