Which versions of OpenIM Server are affected by CVE-2026-69115?

OpenIM Server v3.8.3 contains a critical authorization bypass that allows any authenticated user to enumerate the entire platform's user directory and group structure, including access to private…. A patch is available.

How to fix or mitigate CVE-2026-69115?

Within 24 hours, identify all OpenIM Server v3.8.3 instances in production and assess the duration of exposure; immediately notify platform administrators and security leadership of the data exposure risk. Within 7 days, test the latest patched version of OpenIM Server in a non-production environment and deploy the patch to all production systems. Within 30 days, review authentication logs and API access records for the GetPaginationUsers, GetAllUserID, and GetGroups endpoints during the exposure window to detect unauthorized enumeration activity; notify affected users and relevant compliance teams if unauthorized access is confirmed.

OpenIM Server CVE-2026-69115

Q: What is the CVSS score of CVE-2026-69115?

CVE-2026-69115 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-56855 HIGH

Missing Authorization (CWE-862)

2026-08-11 VulnCheck

GHSA-pp5r-q37v-qxvp

Authentication Bypass Openim Server Open Im Server

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable REST endpoint, no special conditions, regular bearer token sufficient (PR:L), high confidentiality from full user/group enumeration, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 11, 2026 - 20:05 vuln.today

Analysis Generated

Aug 11, 2026 - 20:05 vuln.today

CVE Published

Aug 11, 2026 - 18:21 cve.org

HIGH 7.1

DescriptionCVE.org

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.

AnalysisAI

Missing authorization in OpenIM Server v3.8.3 allows any authenticated user to invoke admin-only REST API endpoints and enumerate the entire platform's user and group data. The GetPaginationUsers, GetAllUserID, and GetGroups RPC handlers in internal/rpc/user/user.go and internal/rpc/group/group.go lack the required authverify.CheckAdmin() guard, meaning a regular bearer token is sufficient to harvest all user IDs, nicknames, manager-level flags, and full group listings including private groups the caller has never joined. No public exploit has been identified at time of analysis, but the low attack complexity makes opportunistic exploitation trivial for any credentialed platform user.

Technical ContextAI

OpenIM Server is an open-source Go-based instant messaging backend maintained by OpenIMSDK (CPE: cpe:2.3:a:openimsdk:openim_server_(open-im-server):*:*:*:*:*:*:*:*). The vulnerability is a textbook CWE-862 (Missing Authorization) defect: the server's gRPC/REST handler layer performs authentication (verifying the bearer token is valid) but skips authorization (verifying the caller holds an admin role) before serving sensitive management data. The upstream commit 193870b2f938278b27a2d8347bd7e4db5f8f9dfc inserts authverify.CheckAdmin(ctx) at the start of three handlers - GetPaginationUsers and AccountCheck in user.go, and GetGroups in group.go - confirming these were the precise missing call sites. The fix is straightforward, indicating the authorization framework existed but was simply not invoked.

RemediationAI

Apply the upstream fix by deploying a build that incorporates commit 193870b2f938278b27a2d8347bd7e4db5f8f9dfc (https://github.com/openimsdk/open-im-server/commit/193870b2f938278b27a2d8347bd7e4db5f8f9dfc), introduced via pull request #3781 (https://github.com/openimsdk/open-im-server/pull/3781). Note that this is an upstream commit and PR fix; a tagged release version incorporating the patch has not been independently confirmed at time of analysis - verify against the OpenIM Server GitHub releases page before deployment. As a compensating control while awaiting a patched build, restrict access to the /user/get_users, /user/get_all_users_uid, and /group/get_groups API paths at the reverse proxy or firewall layer to trusted admin IP ranges only; this prevents exploitation by regular users but will block non-admin tooling that legitimately calls these paths, which is an acceptable trade-off given the admin-only intent of the endpoints. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpoints for additional guidance.