Is CVE-2026-69115 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69115 being exploited in the wild.

How severe is CVE-2026-69115?

Medium severity, with a CVSS score of 6.5, published 11 August 2026.

Is there a fix for CVE-2026-69115?

A patch was published on 2026-08-11: Fix applied in commit 193870b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69115 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-69115?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69115: OpenIM Server missing authorization in admin API endpoints

CVE-2026-69115 · Severity: medium · CVSS 6.5 · Published 2026-08-11

OpenIM Server is an open-source instant messaging platform used for building real-time communication services. A missing authorization check allows any authenticated user to call admin-only API endpoints, enabling unauthorized enumeration of all user accounts and groups—including private groups and sensitive metadata like user IDs and group ownership information—that should be restricted to administrators only.

Quick answers

Is CVE-2026-69115 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69115 being exploited in the wild.
How severe is CVE-2026-69115?: Medium severity, with a CVSS score of 6.5, published 11 August 2026.
Which products and versions are affected?: OpenIM Server 3.8.3.
Is there a fix for CVE-2026-69115?: A patch was published on 2026-08-11: Fix applied in commit 193870b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69115 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-69115?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization flaw (CWE-862) in three API handlers: GetPaginationUsers (/user/get_users), GetAllUserID (/user/get_all_users_uid), and GetGroups (/group/get_groups). The root cause is the absence of an authverify.CheckAdmin() call in these handlers, allowing any authenticated user with a regular bearer token to submit POST requests and access these endpoints. An attacker with valid credentials can enumerate all platform user accounts (userIDs, nicknames, manager flags) and groups (including private groups, names, owner IDs, and member counts). The fix has been confirmed in commit 193870b, which enforces admin access verification for these queries. Network reachability and valid user authentication are required; no additional user interaction is needed.

Affected products

OpenIM Server 3.8.3

Timeline

2026-08-11: disclosed
2026-08-11: patched: Fix applied in commit 193870b

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.