CyberRota Analysis
AI-GeneratedOpenIM Server v3.8.3 has a missing authorization vulnerability that allows authenticated users to access sensitive admin-only API endpoints, enabling them to enumerate all user accounts and groups, including private ones. This could lead to unauthorized disclosure of user IDs, nicknames, and group information, posing a risk to user privacy and system integrity. Organizations using this version of OpenIM Server should prioritize patching to mitigate potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.