Insecure Direct Object Reference in Open Source Social Network Affects User Privacy
CVE-2026-108164

7.1HIGH

Key Information:

Vendor

Opensource-socialnetwork

Status
Opensource-socialnetwork
Vendor
CVE Published:
10 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108164?

The Open Source Social Network (OSSN) through version 10.1 contains an insecure direct object reference vulnerability located in components/OssnMessages/ossn_com.php. This vulnerability enables authenticated users to access private message attachments of other users without proper authorization. By manipulating the /messages/attachment/{guid} route, attackers can exploit sequential or guessed file GUIDs to retrieve sensitive attachments from private conversations, bypassing sender and recipient verification mechanisms.

Affected Version(s)

opensource-socialnetwork 0 <= 10.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108164 - Proof of Concept

References

https://github.com/opensource-socialnetwork/opensource-so...
issue-tracking
https://github.com/opensource-socialnetwork/opensource-so...
patch
https://hackmd.io/@leediay/ossn-idor-message-attachment
exploittechnical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.