paopao-ce EUVD-2026-103071

Requires a valid authenticated account on the target paopao-ce instance (CVSS PR:L); any ordinary registered low-privileged user suffices, with no admin role needed. The DownloadAttachment handler for the /v1/attachment endpoint does not verify that the requesting user owns or is authorized to view the referenced post_content ID, so supplying arbitrary IDs returns signed download URLs for other users' private, friend-only, and following-only media. Exploitation is amplified because content IDs are sequential, enabling trivial enumeration. Limiting factors: an authenticated session is mandatory (not anonymous/unauthenticated), impact is confined to confidentiality of attachments (no write/modify or denial of service), and the issue is present in builds through 0.6.0-alpha.3 under default configuration.

This is a genuine but bounded data-confidentiality issue rather than a critical infrastructure threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity attack that requires an authenticated low-privileged account and yields high confidentiality impact with no integrity or availability impact - consistent with a CWE-639 insecure direct object reference. The reported 7.1 score aligns with that profile: serious for the data exposed, but gated by the need for a valid account and limited to reading other users' private media. No EPSS score, CISA KEV entry, or SSVC decision data was provided, so automatable-exploitation and active-exploitation signals cannot be assessed from the input. There is no indication of active exploitation; however, a detailed public technical write-up (hackmd) and a direct link to the vulnerable source (priv.go L208-250) substantially lower the barrier to reproduction. Signals are mutually consistent (no conflict between the CVSS vector and the description), and the primary risk amplifier is that IDs are sequential, making enumeration trivial for any registered user. Missing data to note explicitly: EPSS/KEV/SSVC are absent, so prioritization beyond the CVSS/technical-write-up evidence cannot be quantified.

An attacker registers or uses any ordinary authenticated account on a paopao-ce instance, then scripts requests to the /v1/attachment endpoint supplying sequential post_content IDs. The server returns signed download URLs for content it does not own, letting the attacker harvest other users' private, friend-only, and following-only images, videos, and attachments. A detailed public write-up describing this enumeration exists, and the low attack complexity (AC:L) means no special timing or conditions are needed beyond holding a valid session.