CVE-2026-108164

Name of the Vulnerable Software and Affected Versions Open Source Social Network (OSSN) versions prior to 10.2

Description An insecure direct object reference (IDOR) exists in the components/OssnMessages/ossn com.php file. This issue allows authenticated users to access private message attachments belonging to other users. By requesting the '/messages/attachment/{guid}' endpoint using sequential or guessed guid values, an attacker can retrieve files from private conversations because the system fails to verify if the requester is the sender or recipient.

Recommendations Update Open Source Social Network (OSSN) to a version later than 10.1.