Community Platform
Monthly
Authenticated users of ONEARMY community-platform before 2.165.2 can mark other users' notifications as read by iterating sequential notification IDs against the POST /api/notifications/:id/read endpoint, which updated the notifications table by ID alone without verifying ownership. The effect is integrity-only and confined to users in the same tenant: victims silently lose unread indicators for replies, comments and new-content notices, and may miss activity they would otherwise respond to. The vendor has released 2.165.2 with the ownership check, and a public technical writeup of the IDOR exists; no public exploit code or active exploitation is confirmed (not in CISA KEV), and the vendor-assigned CVSS 4.0 score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so priority is this-month rather than emergency.
Authenticated users of ONEARMY community-platform before 2.165.2 can mark other users' notifications as read by iterating sequential notification IDs against the POST /api/notifications/:id/read endpoint, which updated the notifications table by ID alone without verifying ownership. The effect is integrity-only and confined to users in the same tenant: victims silently lose unread indicators for replies, comments and new-content notices, and may miss activity they would otherwise respond to. The vendor has released 2.165.2 with the ownership check, and a public technical writeup of the IDOR exists; no public exploit code or active exploitation is confirmed (not in CISA KEV), and the vendor-assigned CVSS 4.0 score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so priority is this-month rather than emergency.