CVE-2026-66091 Details
Description
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
A vulnerability exists in openEQUELLA versions 2019.2 prior to 2026.1, where the GET /api/userquery/userinfobackup endpoint lacks authentication and authorization checks. This allows an unauthenticated attacker to access personal details of users within the same institution by supplying the unique identifier of the target user. The exposed information includes the user's last-known username, first name, last name, and email address. This vulnerability arises because the application does not verify the identity or privileges of the requester before disclosing sensitive user information.
Users can upgrade to openEQUELLA version 2026.1.0 or later, where this endpoint has been removed. For those unable to upgrade immediately, requests to this endpoint can be blocked at a reverse proxy, load balancer, or web application firewall.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw | MON-CSIRT | AdvisoryRemedyVendor |
| https://openequella.github.io/guides/ | MON-CSIRT | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | MON-CSIRT |
Affected Products
| Product | Versions |
|---|---|
| openEQUELLA | >= 2019.2, < 2026.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | MON-CSIRT |