Open Source Social Network (OSSN) EUVD-2026-96319

Requires a valid authenticated low-privileged account on the target OSSN instance (PR:L) - not remote-unauthenticated. No non-default configuration is needed: the flaw is in the default /messages/attachment/{guid} route handler in components/OssnMessages/ossn_com.php, which calls ossn_get_file() and outputs the file whenever type'message' and subtype'file:attachment' without checking that the logged-in user is the message sender or recipient. Exploitation further requires knowledge or guessing of attachment file GUIDs, which the description states are sequential or guessable, lowering the practical barrier. Limiting factors: attacker must be a registered user, and success depends on valid GUIDs existing for private conversations; no user interaction is required.

This is a credible but moderate-priority information-disclosure flaw rather than a critical remote-takeover bug. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the assigned score of 7.1 agree with the description: exploitation is remote, low-complexity, requires no user interaction, but does require PR:L - a valid authenticated account on the target OSSN instance. Impact is confined to confidentiality (VC:H, with VI:N/VA:N), consistent with CWE-639 (authorization bypass via user-controlled key / IDOR); there is no code execution, data tampering, or availability impact. A public exploit write-up exists (hackmd), which raises practical exploitability, but the CVE is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. The main caveat: the input Tags label this 'Authentication Bypass', which conflicts with CWE-639 and the description - this is an AUTHORIZATION bypass by an already-authenticated user, not an authentication bypass; the authentication requirement (PR:L) materially limits the attacker population to registered users and should be weighed against the raw score.

An attacker registers or already holds a low-privileged account on an OSSN site, then iterates the /messages/attachment/{guid} route using sequential or guessed file GUIDs. Because the handler does not verify that the requester is the sender or recipient, each valid GUID returns a private conversation's attachment, letting the attacker harvest other users' private files at scale. A public exploit write-up documenting this technique is available.