Skip to content
OpenAdvisories

Vendor

sakaiproject

5 known vulnerabilities.

Products

sakai 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-54050

    Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

    Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() pa…

    sakaiproject sakai org.sakaiproject.profile2:profile2-impl org.sakaiproject.profile2:profile2-api Maven
  • Medium 5.9
    CVE-2025-62710

    Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl

    Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non…

    sakaiproject sakai org.sakaiproject.kernel:sakai-kernel-impl Maven