CVE-2026-54050Medium· 6.5▾ TwilightPoC availableSakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.r…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.3%
Last analysed / modified upstream
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.sakaiproject.profile2:profile2-api >= 23.0, < 23.5org.sakaiproject.profile2:profile2-api >= 25.0, <= 25.2org.sakaiproject.profile2:profile2-impl >= 23.0, < 23.5org.sakaiproject.profile2:profile2-impl >= 25.0, <= 25.2Patched in:
org.sakaiproject.profile2:profile2-api 23.5org.sakaiproject.profile2:profile2-impl 23.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54049High· 8.7Sakai is a Collaboration and Learning Environment (CLE)
CVE-2025-62710Medium· 5.9Sakai is a Collaboration and Learning Environment
CVE-2021-46416High· 8.1Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
CVE-2026-102986High· 8.1Plane is an open-source project management tool
CVE-2026-102980Medium· 6.5Plane is an open-source project management tool
CVE-2026-102663Medium· 4.3OpenList is a file list program that supports multiple storage backends