CVE-2026-108164

Medium

Description

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.

SeverityMedium

CVSS6.5

Exploit probability—

ProductOpensource-socialnetwork

PublishedOct 10, 2026

First seenOct 10, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Patches

github.com/opensource-socialnetwork/opensource-socialnetwork/commit/2e9733d8eaafccdaef3d9b498348c8332e51f48b

Affected products

Product	Affected versions	Fixed in
opensource-socialnetwork opensource-socialnetwork	v ≤ 10.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.