CVE-2026-69115 PUBLISHED

OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints

Assigner: VulnCheck
Reserved: 03.08.2026 Published: 11.08.2026 Updated: 11.08.2026

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor OpenIMSDK
Product OpenIM Server (open-im-server)
Versions Default: affected
  • affected from 0 to 3.8.3 (incl.)

Credits

  • George Chen finder

References

Problem Types

  • Missing Authorization CWE