CVE-2018-16704

Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in Gleez CMS versions 1.2.0 and 1.3.0. The user profile endpoint at /user/{id} does not verify that the currently authenticated user has permission to view the requested profile. This allows a logged-in user to access the profile of any other user simply by changing the numeric user ID in the URL [1][3].

Exploitation

An attacker must have a valid user account on the Gleez CMS instance. After logging in (e.g., with the demo credentials: username demo, password demo), the attacker can navigate to their own profile, which populates the URL as https://example.com/user/3 [2][3]. By modifying the ID in the URL (e.g., user/4, user/5), the attacker can browse profiles of other users without any additional authentication or authorization checks [1][3].

Impact

A successful attack allows the attacker to view the following information from other users' profiles: username, profile photo, last visited date, joined date, and number of visits [3]. The vulnerability does not permit modification of any data or escalation to other actions, but it does leak personally identifiable and account-usage information to unauthorized users, violating the intended access control [1].

Mitigation

The Gleez CMS repository has been archived and is no longer maintained [3]. No patched version has been released. As a workaround, site administrators can implement custom middleware or HTTP access controls to validate user ownership or role-based permissions for the profile endpoint. Because the project is end-of-life, upgrading to an active fork or alternative CMS may be the most practical long-term solution.