{"schema":"threatline.record/2","record":{"id":"CVE-2026-71854","aliases":["GHSA-47wr-wp4h-8v3f"],"summary":"OpenAEV has unauthenticated access and missing object-level authorization on player lessons API","details":"OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.","categories":["Unclassified"],"product":"openaev","vendor":"OpenAEV-Platform","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71854","source_modified_at":"2026-10-15T15:05:19.156Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"openaev","vendor":"OpenAEV-Platform","versions":[{"version":"< 2.260622.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00245,"percentile":0.14886,"score_date":"2026-10-23"},"published_at":"2026-10-14T20:05:05.232Z","modified_at":"2026-10-15T15:05:19.156Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-71854","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T15:05:19.156Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71854","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-47wr-wp4h-8v3f","tags":["x_refsource_CONFIRM"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-15T13:55:51.211773Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T15:05:19.156Z","content_hash":"ea1f93fec38acc2e64ce8364d73f1145f839089fc8f8da0b3257aa0e08ead36e"}}