{"id":"CVE-2026-71854","summary":"OpenAEV has unauthenticated access and missing object-level authorization on player lessons API","details":"OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.","aliases":["GHSA-47wr-wp4h-8v3f"],"modified":"2026-10-15T10:48:12.831506611Z","published":"2026-10-14T20:05:05.232Z","database_specific":{"cwe_ids":["CWE-306","CWE-639","CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71854.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71854.json"},{"type":"ADVISORY","url":"https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-47wr-wp4h-8v3f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71854"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openaev-platform/openaev","events":[{"introduced":"0"},{"fixed":"6fa23d70a808cb3c5a38da63b95577a3eb10ca41"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"2.260622.0"}]}}],"versions":["2.260619.0","2.260615.0","2.260612.0","2.260604.0","2.260603.1","2.260603.0","2.260601.0","2.260529.0","2.260527.0","2.260525.0","2.260520.0","2.3.5","2.3.4","2.3.3","2.3.2","2.3.1","2.3.0","2.2.1","2.2.0","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.0","2.0.14","2.0.13","2.0.12","2.0.11","2.0.10","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","2.0.0","1.18.20","1.18.19","1.18.18","1.18.17","1.18.16","1.18.15","1.18.14","1.18.13","1.18.12","1.18.11","1.18.10","1.18.9","1.18.8","1.18.7","1.18.6","1.18.5","1.18.4","1.18.3","1.18.2","1.18.1","1.18.0","1.16.1","1.16.0","1.15.2","1.15.1","1.15.0","1.14.1","1.14.0","1.13.1","1.13.0","1.12.2","1.12.1","1.12.0","1.10.0","1.7.0","1.6.0","1.5.0","1.4.0","1.3.1","1.3.0","1.2.1","1.2.0","1.1.1","1.1.0","1.0.9","1.0.8","1.0.7","1.0.6","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71854.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}]}