Medium severity4.3GHSA Advisory· Published Dec 20, 2024· Updated Apr 15, 2026

CVE-2024-55186

Description

An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
Oqtane.FrameworkNuGet	<= 6.0.0	—
Oqtane.ClientNuGet	<= 6.0.0	—
Oqtane.ServerNuGet	<= 6.0.0	—
Oqtane.SharedNuGet	<= 6.0.0	—

Affected products

Oqtane/Oqtane.frameworkGHSA
Range: <= 6.0.0
ghsa-coords4 versions
pkg:nuget/oqtane.client pkg:nuget/oqtane.framework pkg:nuget/oqtane.server pkg:nuget/oqtane.shared
<= 6.0.0+ 3 more
- (no CPE)range: <= 6.0.0
- (no CPE)range: <= 6.0.0
- (no CPE)range: <= 6.0.0
- (no CPE)range: <= 6.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-2hr5-cvwp-jr5wghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-55186ghsaADVISORY
gist.github.com/SmitShah1518/00de9ecc46c1a8e2b189185c9d92afb0nvdWEB
github.com/oqtane/oqtane.framework/pull/4876/filesnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000