Authentication and Authorization Flaw in openEQUELLA by TAFE Queensland

CVE-2026-66091

What is CVE-2026-66091?

In openEQUELLA versions prior to 2026.1, a significant security issue exists within the GET /api/userquery/userinfobackup endpoint that lacks proper authentication and authorization checks. This flaw allows an unauthorized individual to exploit the system by providing another user's unique ID and subsequently gain access to sensitive personal information—including usernames, first names, last names, and email addresses—of users within the same organization. Immediate action is recommended to mitigate the risk of unauthorized data exposure.

References