CVE-2026-85210 — Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attack…
Published: 2026-09-03 · CVSS: 5.3 · CVSS 4.0
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7