CVE-2026-71854
8.2HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-306, CWE-639, CWE-862
Impact
Unauthenticated remote attackers who know an exercise UUID can read lessons-learned questions, view author identities, and forge or overwrite answers under arbitrary user IDs. They only need network access to the API.
Root cause
The `/api/player/**` lessons endpoints lack authentication and blindly trust a caller-supplied `userId` query parameter without authorization checks.
Affected systems
OpenAEV versions prior to 2.260622.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Fix & remediation
Upgrade OpenAEV to version 2.260622.0 or higher. If you cannot upgrade immediately, block external network access to the `/api/player/**` paths at your reverse proxy or firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.