Description
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| oppia | oppia | ≤ 3.5.2 | — |
References
- GitHub Issue #26652 issue-tracking
- https://github.com/oppia/oppia product
- core/controllers/admin.py at v3.5.2 technical-description
- VulnCheck Advisory: Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET third-party-advisory