CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image
Authenticated users can delete any other user's profile image or pronunciation recording due to missing ownership checks in the API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54050?
CVE-2026-54050 is a medium-severity missing authorization vulnerability in sakaiproject sakai, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.
Weakness: CWE-639
Which versions are affected by CVE-2026-54050?
8 open source packages ship an affected version, including org.sakaiproject.profile2:profile2-api and org.sakaiproject.profile2:profile2-impl.
| Package | Affected | Fixed in |
|---|---|---|
org.sakaiproject.profile2:profile2-api Maven | From 23.0 | 23.5 |
org.sakaiproject.profile2:profile2-api Maven | From 23.0 | 23.5 |
org.sakaiproject.profile2:profile2-api Maven | From 25.0 to 25.2 | None |
org.sakaiproject.profile2:profile2-api Maven | From 25.0 to 25.2 | None |
org.sakaiproject.profile2:profile2-impl Maven | From 23.0 | 23.5 |
org.sakaiproject.profile2:profile2-impl Maven | From 23.0 | 23.5 |
2 more packages
org.sakaiproject.profile2:profile2-impl Maven | From 25.0 to 25.2 | None |
org.sakaiproject.profile2:profile2-impl Maven | From 25.0 to 25.2 | None |
How do I fix CVE-2026-54050?
Upgrade org.sakaiproject.profile2:profile2-api to 23.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54050 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54050 exists.
Sources
Also known as GHSA-9284-fjc3-fmmj.