Executive brief
Sakai is a learning management system used by educational institutions to manage courses, student records, and user profiles. A flaw in the REST API allows any authenticated student or guest user to permanently delete the profile photo of any other user, including administrators and instructors, by simply specifying a different username in a web request. An attacker could systematically delete profile photos across the entire platform, disrupting identity verification systems used in proctored exams and student directories.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in ProfileController.removeProfileImage(). The controller retrieves the authenticated user's ID via checkSakaiSession() but never compares it to the target userId parameter before calling profileService.removeProfileImage(userId). The service layer delegates directly to the DAO with no authorization check, bypassing all CHS permission controls via a security advisor. The upload endpoint (setProfileImage()) correctly performs an ownership check using sakaiProxy.isSuperUser() and StringUtils.equals(), demonstrating the asymmetry. An attacker with a valid session cookie can craft DELETE requests to /api/users/{admin}/profile/image and permanently remove administrator profile photos. The pronunciation delete endpoint (DELETE /api/users/{userId}/profile/pronunciation) lacks even basic session validation, allowing unauthenticated requests. Patches are available in version 23.5 and later via commit a092dbf3dc6bf343131f50007c207a9abd95e852.
Affected products
- Sakai Project org.sakaiproject.profile2:profile2-api 23.0 to 23.4, 25.0 to 25.2
- Sakai Project org.sakaiproject.profile2:profile2-impl 23.0 to 23.4, 25.0 to 25.2
Timeline
- 2026-08-24: disclosed: Public disclosure via GitHub Advisory Database
- 2026-06-02: patched: Fix committed to master branch (commit a092dbf3dc6bf343131f50007c207a9abd95e852); releases 23.5+ include patch