pig CVE-2026-111343

Requires a valid authenticated account of any privilege level on a pig (pig-mesh) instance version 4.1.1 or earlier; the GET /admin/user/details/{id} endpoint in SysUserController.user performs no per-object ownership/role check, so any logged-in user can request arbitrary user ids. Exploitation is reliable because ids are sequential and enumerable. The key limiting factor is authentication (PR:L) - an unauthenticated outsider cannot reach the data - and impact is confined to reading profile PII; there is no write, privilege-escalation, or availability effect.

This is a medium-severity information-disclosure (IDOR / CWE-862 missing authorization) issue, and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:L only) scores 5.3 and matches the description precisely: a network-reachable endpoint, low attack complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only limited confidentiality impact (per-user PII, no integrity or availability impact). No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this data. The CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation. A detailed public technical write-up (hackmd) and a VulnCheck advisory exist and describe the exact vulnerable endpoint and enumeration technique, so exploitation knowledge is public even though the signal is a write-up rather than a weaponized tool. Net judgment: this is a genuine but moderate priority - trivial to exploit once any account is held, but gated by authentication and limited to reading PII, not code execution or account takeover. It warrants patching on normal cycles for exposed deployments, not emergency response. Note the input tag 'Authentication Bypass' overstates the issue: the attacker must already be authenticated, so this is broken object-level authorization, not an authentication bypass.

An attacker who registers or obtains any low-privilege account on a pig (pig-mesh) instance issues GET /admin/user/details/{id} and simply increments the numeric id to walk the entire user table. Because the endpoint omits per-object authorization, each request returns another user's username, real name, phone, email, linked third-party accounts, and role assignments. A step-by-step public write-up and VulnCheck advisory describe this exact technique, making the attack effectively copy-paste for anyone with a valid session.