CVE-2026-82411

Name of the Vulnerable Software and Affected Versions Open Object versions prior to 2.5.1 Open Object versions prior to 3.6.2 Open Object versions prior to 4.0.2 Open Object versions prior to 4.1.1

Description An issue exists where a non-superuser API token with read access to a single ObjectType can access the full versioned record of objects belonging to any other ObjectType. This occurs via the GET /api/v2/objects/{uuid}/{index} endpoint. The history detail action in src/objects/api/v2/views.py bypasses necessary permission checks by calling self.get queryset() and get object or 404 instead of self.get object(), which prevents the execution of check object permissions and the ObjectTypeBasedPermission.has object permission check. Consequently, the data of versioned objects, potentially including sensitive citizen or case records, can be disclosed.

Recommendations Update to version 2.5.1. Update to version 3.6.2. Update to version 4.0.2. Update to version 4.1.1.