CVE-2026-111649
Received Received - Intake

Insecure Direct Object Reference in Rocboss Paopao-CE

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111649
EUVD
EUVD-2026-103071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rocboss paopao-ce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the paopao-ce social media platform through version 0.6.0-alpha.3. It allows authenticated users to access private media files by supplying arbitrary content IDs. Attackers can exploit this by enumerating sequential post_content IDs via the /v1/attachment endpoint to obtain signed download URLs for other users' private images, videos, and attachments that are restricted to friends-only or following-only access.

Detection Guidance

To detect this IDOR vulnerability, monitor the /v1/attachment endpoint for unauthorized access attempts. Check logs for sequential content ID enumeration by authenticated users. Test by sending GET requests with arbitrary content IDs to see if private media is accessible without proper authorization.

Impact Analysis

If you use paopao-ce, attackers with valid credentials could access your private media files, including images, videos, and attachments that you intended to share only with friends or followers. This could lead to privacy violations, data leaks, or unauthorized access to sensitive content.

Compliance Impact

This vulnerability could lead to non-compliance with privacy regulations like GDPR and HIPAA by exposing personal or sensitive data to unauthorized users. Organizations using paopao-ce may face legal penalties, reputational damage, and loss of user trust due to data breaches resulting from this flaw.

Mitigation Strategies

Immediately update paopao-ce to a patched version beyond 0.6.0-alpha.3. If no patch is available, restrict access to the /v1/attachment endpoint via firewall rules. Implement server-side checks to verify media ownership before allowing downloads. Review logs for past exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart