CVE-2026-71854 Details

A vulnerability exists in OpenAEV versions prior to 2.260622.0, allowing unauthenticated access to the '/api/player/**' lessons endpoints. These endpoints trust a client-supplied 'userId' query parameter without verifying the caller's identity or exercise membership. An unauthenticated client aware of an exercise UUID can read lessons-learned questions and answers, including the identity of answer authors, and can create or overwrite answers for any user. This issue arises because the player lessons endpoints are open to all users by default, and the 'userId' parameter is used to impersonate users without proper validation.

To address this vulnerability, implement an exercise-membership check on all affected API handlers. Derive the player identity from the authenticated session or token instead of a client-supplied 'userId'. Additionally, ensure that the API returns appropriate 401 or 403 responses for anonymous or non-member requests.