CVE-2026-53673 Details

A vulnerability allowing insecure direct object reference has been identified in BuddyPress version 14.4.0. This issue resides within the messages REST API, where authenticated attackers can access private message threads by manipulating the user_id parameter in their requests. The vulnerability arises because the get_item_permissions_check method validates the supplied user_id instead of the logged-in user's ID. This flaw is particularly concerning as it allows attackers to read, reply to, or delete any user's private messages. The issue is exacerbated by the fact that the same validation method is reused in update and delete handlers, creating multiple avenues for exploitation.