{"schema":"threatline.record/2","record":{"id":"CVE-2026-82411","aliases":["GHSA-55w6-rqp5-j5wx"],"summary":"Objects API: Cross-object-type authorization bypass on the object history-detail endpoint","details":"Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint `GET /api/v2/objects/{uuid}/{index}`. The `history_detail` action in `src/objects/api/v2/views.py` calls `self.get_queryset()` and `get_object_or_404` directly instead of `self.get_object()`, so `check_object_permissions` and the per-object check in `ObjectTypeBasedPermission.has_object_permission` are not invoked. The queryset's `filter_for_token` applies only to the list and search actions, while `ObjectTypeBasedPermission.has_permission` allows non-create actions, leaving neither check to constrain history-detail records to the token's permitted ObjectType. The normal retrieve endpoint returns 403 for the same unauthorized object, and the sibling history action enforces the grant. Any valid non-superuser API token with a read grant on at least one ObjectType can therefore disclose another ObjectType's complete versioned object `data`, which can include citizen or case records and sensitive identifiers in government deployments. This issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.","categories":["Unclassified"],"product":"open-object","vendor":"maykinmedia","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82411","source_modified_at":"2026-10-28T22:40:13.728Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"open-object","vendor":"maykinmedia","versions":[{"version":">= 2.4.3, < 2.5.1","status":"affected"},{"version":">= 3.0.0, < 3.6.2","status":"affected"},{"version":">= 4.0.0-rc.1, < 4.0.2","status":"affected"},{"version":">= 4.1.0, < 4.1.1","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T22:40:13.728Z","modified_at":"2026-10-28T22:40:13.728Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-82411","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T22:40:13.728Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/security/advisories/GHSA-55w6-rqp5-j5wx","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/commit/11c5b85ea5d1d80f940883f01b8b8ea80ccdd47c","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/commit/27e806eff04c52ebe1e78126c288b63fc0308b52","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/commit/6154d9c2ed8c162b61f2d42db2de4eda5081347f","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/commit/ce6b1820619c843748bc5231597aa7fc060d95fe","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/tree/2.5.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/tree/3.6.2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/tree/4.0.2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/maykinmedia/open-object/tree/4.1.1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T22:40:13.728Z","content_hash":"68242e382ad78e66a67552db9d7505fa45f769563634caede087564fd088532b"}}