CVE-2026-108164 — Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users…
Published: 2026-10-10 · CVSS: 7.1 · CVSS 4.0
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7