{"id":"CVE-2026-54050","summary":"Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image","details":"Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.","aliases":["GHSA-9284-fjc3-fmmj"],"modified":"2026-09-17T08:04:59.760534Z","published":"2026-09-15T17:09:58.724Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54050.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54050.json"},{"type":"ADVISORY","url":"https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54050"},{"type":"FIX","url":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sakaiproject/sakai","events":[{"introduced":"5d29a6077bcf22c8a9d2860fd655d7caecf3ab43"},{"introduced":"4e5584bd462efb886ee35704724704460b2f4508"},{"fixed":"a092dbf3dc6bf343131f50007c207a9abd95e852"}],"database_specific":{"extracted_events":[{"introduced":"23.0"},{"fixed":"23.5"},{"introduced":"25.0"},{"last_affected":"25.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54050.json","vanir_signatures_modified":"2026-09-17T08:04:59Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"292135069448079761781759291608452041619","length":645},"id":"CVE-2026-54050-0564a827","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java","function":"getProfileImageDetails"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"function":"removeProfileImage","file":"webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java"},"deprecated":false,"digest":{"function_hash":"64825415130292172198043174221701049549","length":283},"id":"CVE-2026-54050-150ed1bb"},{"id":"CVE-2026-54050-26d4630a","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java","function":"removeProfileImage"},"deprecated":false,"digest":{"function_hash":"301122907128876202002970223589104072948","length":171}},{"deprecated":false,"digest":{"line_hashes":["237592703521276785384576195670929717058","25803431913409818426877088820290961472","251771433612988916953215570058426088978","57947018528034562418492886990498598759","312216269597950555874172652301759899886","168867910587746431150691520605166837715","291155611493757325110879680224352801535","176482782494313016323128516348212019401","335454301542974227604901591547979153523","212173240820079280748900040222478694874","335185905119780238041700155751615523950","20715424469151110509337546311658046427","335220636205516686865665718278643234000","224144494422568441031065135843345028294","331309449277764895566530857277507263294","45292517004303381199999874687998664203","243282152433778734071925465296779667854","85088400934937181651849844245019342028","198913369159162163788292824428497625890","138176883400253335435721866221795256847","88472821676382375810990006433201354440","29865756697006279907239907567160265526","218837609748306492139135824859407618591","79544139344468027657131616237461978199","297875753119136475286402795057607256111","278781517846577379628599202548491356253","328097602999219401366693764141042361763","123830729212058704094202096031938698699","264194153125882339556046718425435864689","327828157969875580097246772249924607457","160349115837526205837818650529945698118","125790453301076299446313730763239983799","138176883400253335435721866221795256847","192395954617205405496323219177047148476","175593248497858003199508566925253275421","142357329783324635664484497352421507025","250421666624047071889132129667334880565","151693366406682531895257526693267952504","292288985333498937508647340279406869472","113204204077559461098121757740323273732","297874225728664442239732578876475387334"],"threshold":0.9},"id":"CVE-2026-54050-279b734e","signature_type":"Line","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java"}},{"target":{"file":"profile2/impl/src/test/org/sakaiproject/profile2/impl/test/ProfileServiceTests.java","function":"setup"},"deprecated":false,"digest":{"function_hash":"79392077662472707820702605679985951317","length":635},"id":"CVE-2026-54050-2b6b3912","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"},{"digest":{"length":585,"function_hash":"145322542068915487263858422615837452945"},"id":"CVE-2026-54050-3292390d","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java","function":"putProfileImage"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java","function":"setProfileImage"},"deprecated":false,"digest":{"function_hash":"43188738669636266396645650297625222621","length":1914},"id":"CVE-2026-54050-53599d15"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"profile2/api/src/main/java/org/sakaiproject/profile2/api/ProfileService.java"},"deprecated":false,"digest":{"line_hashes":["119900536923498291975269729450372286956","281522528794004341043734103112476731079","40833128464734280932873468996381903441"],"threshold":0.9},"id":"CVE-2026-54050-58c553bf"},{"target":{"file":"profile2/impl/src/test/org/sakaiproject/profile2/impl/test/ProfileServiceTests.java"},"deprecated":false,"digest":{"line_hashes":["149557919288369831106397953068761907689","208081986310511382129691148635943866612","197080923018133486941287460195902044323","148876670767275858621412747430658348223","107049881573652715918469450418422227929","197381042532217396725346749203191359848","74984171324936542878172168528032578732","30020214373382000517162008560938942000","64896844741782831925432399359771187891","67747069567161644207947515891071834664","106124385507630441128183738276330936466","273064868066444277800138610728403982165","53297630088661255342246341439262119028","164391193255838411959254763089273705103","231008774201898540818125335326238975042","316136514621800205178739883701724701","228969230271887102612097241514791280018","42095645363124285241858803796483095422","296411674106391595594716512166800675104","145103872230823000350909056645247213249","294767021523237099665925636211017365523","321714738385412459654135992551544207493"],"threshold":0.9},"id":"CVE-2026-54050-9056a504","signature_type":"Line","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"},{"target":{"file":"webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java","function":"removeNamePronunciation"},"deprecated":false,"digest":{"function_hash":"133658321633692296833805518293453858907","length":132},"id":"CVE-2026-54050-9936a155","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"webapi/src/main/java/org/sakaiproject/webapi/exception/GlobalExceptionHandler.java"},"deprecated":false,"digest":{"line_hashes":["238007017879265249882143921692269741766","297978556168802333937958311311580594693","130426725799730390428362649995880075545"],"threshold":0.9},"id":"CVE-2026-54050-c4234bd7"},{"digest":{"function_hash":"276972070752433183233756286552281903974","length":731},"id":"CVE-2026-54050-d2512964","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"webapi/src/main/java/org/sakaiproject/webapi/controllers/ProfileController.java","function":"patchProfile"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"214009578065296509912454599710540484680","length":197},"id":"CVE-2026-54050-ef3fdc46","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852","target":{"file":"profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java","function":"removePronunciationRecording"}},{"target":{"file":"profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["155769452596479896909557365117119123835","134252943572074938902681901360285290818","53166435041528469787601297220930982366","104039626306194924212487596645717441313","8506691848681316544944361900528852961","17160660786679032912354996987310005872","319208715414078016924889005328195243992","251152483085782212957031183941836988159","252492296496706382640699650860777455051","308573835677217978861036096354261229081","50755118288293614589025602303391407508","145344039729713659530462197916383628105","60460080065253825073785103686349510419","282183731830833930472404045817755358008","1224208902989923748406167528316509745","239348477702600875158081887071151687364","35876284749282727681918568440165462078","100712154835840963763574494906535169097","157744688332510429398614672694115707141","88912709240575729967644881279245694155","319845670817197571791924031638002826471","226904244356426565102617064275307685462","57916515018456481865410268827163187226"],"threshold":0.9},"id":"CVE-2026-54050-f880fda3","signature_type":"Line","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"},{"target":{"file":"profile2/impl/src/main/java/org/sakaiproject/profile2/impl/ProfileServiceImpl.java","function":"saveUserProfile"},"deprecated":false,"digest":{"function_hash":"231010272665514206607234409262517807012","length":1103},"id":"CVE-2026-54050-ff47dbe2","signature_type":"Function","signature_version":"v1","source":"https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}