API Misconfiguration in Open Object Allows Unauthorized Data Access
CVE-2026-82411
6.5MEDIUM
What is CVE-2026-82411?
The Open Object API has a vulnerability where a token designed for one ObjectType can unintentionally retrieve full versioned records of objects across different ObjectTypes. This occurs due to an improper handling of permissions in the history-detail endpoint, allowing non-superuser tokens to access potentially sensitive records, including government case files. To mitigate this risk, users should upgrade to the patched versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.
Affected Version(s)
open-object >= 2.4.3, < 2.5.1 < 2.4.3, 2.5.1
open-object >= 3.0.0, < 3.6.2 < 3.0.0, 3.6.2
open-object >= 4.0.0-rc.1, < 4.0.2 < 4.0.0-rc.1, 4.0.2