CVE-2026-69115

Name of the Vulnerable Software and Affected Versions OpenIM Server version 3.8.3

Description An authorization flaw allows authenticated users to access administrative management API endpoints by sending POST requests using a standard user bearer token. This occurs because the authverify.CheckAdmin() function is not called within the GetPaginationUsers(), GetAllUserID(), and GetGroups() handlers. An attacker can use this to enumerate all platform user accounts, including userIDs, nicknames, and manager level flags, as well as all groups, including private ones, exposing group names, owner IDs, and member counts. The affected API endpoints are '/user/get users', '/user/get all users uid', and '/group/get groups'.

Recommendations For OpenIM Server version 3.8.3, restrict access to the '/user/get users', '/user/get all users uid', and '/group/get groups' API endpoints to prevent unauthorized enumeration.