Insecure Direct Object Reference in LingGuo-Drama Affects User Project Access

CVE-2026-111722

What is CVE-2026-111722?

The LingGuo-Drama application is susceptible to an insecure direct object reference vulnerability that enables registered users to gain unauthorized access to other users' project data. This vulnerability arises from the absence of an ownership check in the projects.Get method, permitting self-registered attackers to exploit numeric IDs through GET, PUT, and DELETE requests to the /admin/v1/projects/:id endpoint. This flaw can lead to unauthorized reading, overwriting, reassigning, or deletion of any user's short-drama projects, significantly compromising the privacy and integrity of user information.

References