Authorization Bypass Vulnerability in Movim by Movim
CVE-2026-125379

2.3LOW

Key Information:

Vendor

Movim

Status
Movim
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125379?

Movim versions up to 0.35.5 exhibit an authorization bypass vulnerability in the Post::ajaxGetPost function. This flaw allows authenticated users to access restricted posts by manipulating server, node, and nodeid parameters. Attackers aware of specific identifiers can exploit this issue to read cached community or contact-only posts from the pod-wide cache prior to the execution of the XMPP authorization check, potentially compromising sensitive information.

Affected Version(s)

movim 0 <= 0.35.5

References

https://github.com/movim/movim/commit/378e0368368d0dd9cb0...
patch
https://github.com/movim/movim
product
https://github.com/movim/movim/blob/v0.35.5/app/Widgets/P...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
Timothée Jaussoin
.