Arbitrary User Information Modification in Gaudire's Assassin Game

CVE-2026-7165

What is CVE-2026-7165?

A vulnerability exists in the 'addJugador' endpoint of Gaudire's Assassin Game that allows authenticated users to manipulate other users' information due to inadequate authorization checks. Attackers can modify user IDs and gain unauthorized access to sensitive data, such as internal IP addresses and local files, by exploiting the system's lax input validation. Additionally, administrative privileges can be self-assigned without proper authentication, paving the way for privilege escalation. The presence of long numeric inputs can lead to system crashes, enabling denial-of-service attacks. These issues highlight serious security oversights that could have significant implications for user data and game integrity.

References