CVE-2026-54050
Received Received - Intake

Authenticated User Profile Image Deletion in Sakai

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54050
EUVD
EUVD-2026-78875

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
sakai_project sakai 23.0
sakai_project sakai 23.5
sakai_project sakai 25.3
sakai_project sakai 26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54050 is an Insecure Direct Object Reference (IDOR) vulnerability in the Sakai learning management system. It allows authenticated users to delete another user's profile image or pronunciation recording by manipulating the userId parameter in API requests. The issue occurs because the service layer lacks proper authorization checks to verify ownership before deletion.

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to /api/users/{userId}/profile/image and /api/users/{userId}/profile/pronunciation endpoints. Check for repeated deletions from non-owner accounts or unauthorized session access. Review logs for requests with mismatched userId parameters and session owners.

Impact Analysis

An attacker could repeatedly delete profile images or recordings of other users, including administrators or instructors. This could disrupt identity verification workflows in educational settings, allow bulk deletions across the platform, and cause permanent loss of profile identity artifacts that are critical for system operations.

Compliance Impact

This vulnerability could lead to unauthorized data modification, potentially violating integrity requirements in GDPR and HIPAA. Permanent deletion of profile images or recordings may compromise audit trails and user identity verification processes required by these regulations.

Mitigation Strategies

Upgrade Sakai to versions 23.5, 25.3, or 26.0 immediately. If upgrading is not possible, implement strict input validation to ensure userId matches the session owner. Add session validation for the pronunciation endpoint and enforce ownership checks in the service layer.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54050. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart