Askbot
CVE-2026-1213
MEDIUM
GHSA-r2jv-fwfr-4j8c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable IDOR requiring low-privilege authentication with no scope change; only limited integrity impact (profile picture modification) and no confidentiality or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.
AnalysisAI
Unauthorized profile picture modification in Askbot 0.12.2 and all earlier versions allows any authenticated low-privilege user to overwrite another account's avatar by exploiting an insecure direct object reference (CWE-639), bypassing per-user ownership checks entirely. The flaw is network-exploitable with no attack complexity barrier, but impact is limited to low integrity (profile image defacement) with no confidentiality or availability consequence. No public exploit identified at time of analysis; EPSS stands at 0.01% (2nd percentile) and the vulnerability does not appear in CISA KEV, indicating very low observed exploitation activity.
Technical ContextAI
Askbot is an open-source, Django-based question-and-answer community platform. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of insecure direct object reference (IDOR) flaws where an application uses a caller-supplied identifier - such as a user ID or username in a request parameter - to locate and modify a resource without verifying the authenticated session is authorized to act on that specific resource. In this instance, the profile picture update endpoint likely accepts an arbitrary account identifier rather than binding the write operation to the session owner, allowing lateral modification across user accounts. The CPE string cpe:2.3:a:askbot:askbot:*:*:*:*:*:*:*:* confirms all versions through and including 0.12.2 are affected. A corrective commit is available upstream at https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d.
RemediationAI
Apply the upstream fix committed to the Askbot repository at https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d. Patch availability is confirmed per vendor advisory data; however, no specific patched release version number has been independently confirmed from the available data - verify that the latest tagged release on the Askbot GitHub repository incorporates this commit before upgrading. The Fluid Attacks advisory at https://fluidattacks.com/advisories/ghost may contain additional remediation context. If immediate patching is not feasible, restrict the profile picture update endpoint at the web server or WAF layer to reject requests where the target account identifier does not match the authenticated session's own user context; note this mitigation requires accurate request pattern matching and may inadvertently block legitimate self-update requests if misconfigured. Alternatively, disabling the profile picture editing feature entirely eliminates the attack surface with no integrity risk, at the cost of removing user customization functionality.
Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary w
Cross-site scripting (XSS) vulnerability in Askbot before 0.7.49 allows remote attackers to inject arbitrary web script
Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch. Rated medium severity (CVSS 6.1), this vulnerabi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today