CVE-2026-116018 ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116018?
CVE-2026-116018 is a medium-severity vulnerability in ONEARMY community-platform, published on 24 Oct 2026.
Official description
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.
Weakness: CWE-639
Which versions are affected by CVE-2026-116018?
How do I fix CVE-2026-116018?
No fix has been published for CVE-2026-116018 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116018 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116018 exists.
Sources
Also known as GHSA-rq5g-4m5j-8p36.