CVE-2026-111722 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in the LingGuo-Drama application, specifically in the project management API. This vulnerability allows registered users to access, modify, or delete other users' projects. The issue arises because the 'projects.Get' function does not verify project ownership. Attackers can exploit this by iterating through numeric project IDs via the 'GET', 'PUT', and 'DELETE' methods on the '/admin/v1/projects/:id' endpoint. This flaw enables them to read, overwrite, reassign, or delete any user's short-drama projects.

The vulnerability can be addressed by implementing proper ownership checks in the project ID handlers to ensure that users can only access their own projects. Additionally, the account management routes should be gated behind authorization checks that verify the user's role and require current password verification for sensitive actions.