Medium severity · published Oct 29, 2026
CVE-2026-66091
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
New
6.9
CVSS
–
EPSS
No
On KEV
Description
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openEQUELLA · Apereo Foundation
2019.2 before 2026.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66091
vendor-advisory
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw
product
https://openequella.github.io/guides/
More from openEQUELLA
9.4
CVE-2026-66088
Unrestricted Command Execution via system.execute
8.8
CVE-2026-67615
openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
7.1
CVE-2026-66090
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
6.1
CVE-2026-66089
XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
4.8
CVE-2026-66092
Stored XSS in pre-login notice via reachable legacy logon route