Missing Authorization Vulnerability in pig through 4.1.1 by Pig-Mesh

CVE-2026-111343

What is CVE-2026-111343?

The pig through version 4.1.1 contains a missing authorization flaw in the SysUserController.user endpoint. This vulnerability allows authenticated users to retrieve the profiles of other users by appending their user IDs to the GET request. Low-privilege users can exploit this issue to enumerate user IDs and gain unauthorized access to sensitive information such as usernames, real names, phone numbers, email addresses, linked accounts, and role assignments.

References