Insecure Direct Object Reference in ONEARMY Community Platform

CVE-2026-116018

What is CVE-2026-116018?

The ONEARMY community-platform prior to version 2.165.2 suffers from an insecure direct object reference vulnerability. This issue allows authenticated users to manipulate the notification system through the API endpoint that marks notifications as read. By iterating through sequential notification IDs, an attacker can hide unread notifications from other users within the same tenant. This could lead to significant communication gaps, as targeted users may not realize they have missed crucial replies, comments, or updates due to unmarked notifications.

References