LingGuo-Drama CVE-2026-111722

Requires a valid authenticated account on the target LingGuo-Drama instance, obtainable via self-registration, and that the instance runs the vulnerable code at/through commit 8a6924a where projects.Get omits an owner check. The attacker then issues GET, PUT, or DELETE requests to /admin/v1/projects/:id with iterated numeric IDs. Limiting factors: exploitation is not fully unauthenticated (a low-privilege registered account is needed, hence PR:L), it depends on self-registration being enabled, and it targets a niche, self-hosted application rather than default internet-facing enterprise software; no user interaction or special client is required beyond network access to the admin API.

This is a textbook broken-access-control / IDOR flaw (CWE-639) whose signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, 8.6 High) aligns well with the description: a network-reachable REST API, low complexity, no user interaction, and only low privileges (any self-registered account) needed to achieve high confidentiality and integrity impact across all other tenants' projects. The low-privilege requirement is the single most important mitigating factor and is honestly reflected as PR:L (not PR:N), because exploitation presupposes the attacker can register and authenticate. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no exploit-code flag was provided, so there is no evidence of active exploitation or weaponized tooling. However, a detailed public technical write-up (hackmd) and a VulnCheck advisory exist that pinpoint the exact vulnerable source lines, which materially lowers the effort to reproduce the bug even though formal 'POC=YES' was not asserted. Net: the vulnerability class is trivially exploitable once an account exists, but real-world urgency is tempered by the product's apparent obscurity and the authentication prerequisite - this reads as a genuine design flaw worth patching rather than an internet-wide emergency.

An attacker self-registers an ordinary account on a LingGuo-Drama instance, authenticates, and then simply increments the numeric :id value in requests to /admin/v1/projects/:id. Because projects.Get performs no ownership check, the attacker reads, overwrites, reassigns, or deletes other users' short-drama projects at will. No public exploit binary is required - the flaw is exploitable with any HTTP client, and public write-ups already document the exact endpoints and vulnerable code.