CVE-2026-66091GHSA-mxj9-pmpw-j4xw

openEQUELLA: Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details

Apereo Foundation openEQUELLA

Open in Threatline Record JSON

CVSS

6.9Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in2026.1Fixed versionCVE List

Published29 Oct 2026Updated 29 Oct 2026CVE List

What fixes it

2026.1openEQUELLACVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@cve.skyfleet.blue: CVE-2026-66091 - Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details CVE ID : CVE-2026-66091 Published : Oct. 29, 2026, 2:16 a.m. | 1 hour, 13 minutes ago DeBluesky: CVE posts, 29 Oct 2026

Description

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

Text from CVE List

Affected versions 1

openEQUELLAaffected: 2019.2 before 2026.1CVE List