CVE-2026-116018

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116018
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116018.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-116018
Published
2026-10-24T11:40:34Z
Modified
2026-10-25T02:47:11Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
Details

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116018.json"
}
References

Affected packages

Git / github.com/onearmy/community-platform

Affected ranges

Type
GIT
Repo
https://github.com/onearmy/community-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7fa21f963f0b96eda015c5694c26d2a085c1cb9e
Fixed
571732c26caf1a0a46e5335d275cef2e19dfab08
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.165.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "571732c26caf1a0a46e5335d275cef2e19dfab08"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.165.2",
            "range": [
                {
                    "fixed": "7fa21f963f0b96eda015c5694c26d2a085c1cb9e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.2.0
v0.*
v0.4.0
v1.*
v1.182.0
v1.183.0
v1.185.0
v1.186.0
v1.187.0
v1.188.0
v1.188.1
v1.188.2
v1.188.3
v1.188.4
v1.189.0
v1.190.0
v1.191.0
v1.191.1
v1.192.0
v1.192.1
v1.193.0
v1.194.0
v1.194.1
v1.195.0
v1.195.1
v1.196.0
v1.197.0
v1.198.0
v1.199.0
v1.199.1
v1.199.2
v1.200.0
v1.200.1
v1.201.0
v1.202.0
v1.203.0
v1.203.1
v1.204.0
v1.204.1
v1.205.0
v1.205.1
v1.206.0
v1.206.1
v1.207.0
v1.207.1
v1.208.0
v1.208.1
v1.209.0
v1.210.0
v1.210.1
v1.211.0
v1.211.1
v1.212.0
v1.212.1
v1.213.0
v1.214.0
v1.215.0
v1.216.0
v1.217.0
v1.217.1
v1.217.2
v1.218.0
v1.219.0
v1.219.1
v1.220.0
v1.3.0
v1.4.0
v1.5
v1.6.0
v1.9.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.100.0
v2.101.0
v2.101.1
v2.102.0
v2.103.0
v2.103.1
v2.104.0
v2.104.1
v2.105.0
v2.105.1
v2.105.2
v2.105.3
v2.106.0
v2.106.1
v2.107.0
v2.107.1
v2.108.0
v2.109.0
v2.11.0
v2.110.0
v2.111.0
v2.112.0
v2.112.1
v2.113.0
v2.113.1
v2.113.2
v2.114.0
v2.115.0
v2.115.1
v2.116.0
v2.116.2
v2.117.0
v2.117.1
v2.117.2
v2.117.3
v2.117.4
v2.117.5
v2.117.6
v2.117.7
v2.117.8
v2.118.0
v2.118.1
v2.118.2
v2.119.0
v2.12.0
v2.12.1
v2.120.0
v2.120.1
v2.120.2
v2.121.0
v2.121.1
v2.122.0
v2.123.0
v2.123.1
v2.123.2
v2.124.0
v2.125.0
v2.125.1
v2.125.2
v2.126.0
v2.126.1
v2.126.2
v2.127.0
v2.127.1
v2.128.0
v2.129.0
v2.129.1
v2.129.2
v2.13.0
v2.13.1
v2.130.0
v2.130.1
v2.131.0
v2.131.1
v2.132.0
v2.133.0
v2.134.0
v2.135.0
v2.136.0
v2.136.1
v2.137.0
v2.137.1
v2.138.0
v2.139.0
v2.139.1
v2.14.0
v2.140.0
v2.140.1
v2.140.2
v2.140.3
v2.141.0
v2.142.0
v2.142.1
v2.142.2
v2.142.3
v2.142.4
v2.142.5
v2.143.0
v2.144.0
v2.145.0
v2.146.0
v2.146.1
v2.146.2
v2.146.3
v2.147.0
v2.147.1
v2.148.0
v2.148.1
v2.148.2
v2.148.3
v2.149.0
v2.149.1
v2.15.0
v2.15.1
v2.150.0
v2.150.1
v2.151.0
v2.151.1
v2.151.2
v2.151.3
v2.152.0
v2.152.1
v2.153.0
v2.154.0
v2.154.1
v2.155.0
v2.156.0
v2.156.1
v2.157.0
v2.158.0
v2.159.0
v2.159.1
v2.16.0
v2.160.0
v2.161.0
v2.161.1
v2.161.2
v2.161.3
v2.162.0
v2.163.0
v2.163.1
v2.163.2
v2.164.0
v2.164.1
v2.164.2
v2.165.0
v2.165.1
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.22.1
v2.23.0
v2.23.1
v2.24.0
v2.24.1
v2.25.0
v2.26.0
v2.26.1
v2.27.0
v2.28.0
v2.28.1
v2.28.2
v2.29.0
v2.3.0
v2.30.0
v2.30.1
v2.31.0
v2.31.1
v2.31.2
v2.32.0
v2.32.1
v2.33.0
v2.33.1
v2.33.2
v2.34.0
v2.35.0
v2.35.1
v2.36.0
v2.36.1
v2.36.2
v2.37.0
v2.38.0
v2.39.0
v2.39.1
v2.4.0
v2.40.0
v2.41.0
v2.41.1
v2.42.0
v2.42.1
v2.43.0
v2.44.0
v2.44.1
v2.44.2
v2.44.3
v2.44.4
v2.45.0
v2.45.1
v2.46.0
v2.47.0
v2.48.0
v2.48.1
v2.48.2
v2.49.0
v2.49.1
v2.5.0
v2.50.0
v2.51.0
v2.51.1
v2.51.2
v2.51.3
v2.52.0
v2.52.1
v2.53.0
v2.54.0
v2.54.1
v2.54.2
v2.54.3
v2.54.4
v2.55.0
v2.55.1
v2.56.0
v2.57.0
v2.58.0
v2.58.1
v2.58.2
v2.59.0
v2.6.0
v2.60.0
v2.61.0
v2.62.0
v2.63.0
v2.64.0
v2.64.1
v2.64.2
v2.65.0
v2.65.1
v2.66.0
v2.67.0
v2.68.0
v2.68.1
v2.68.2
v2.68.3
v2.68.4
v2.68.5
v2.69.0
v2.7.0
v2.7.1
v2.70.0
v2.70.1
v2.72.0
v2.72.1
v2.72.2
v2.73.0
v2.74.0
v2.74.1
v2.74.2
v2.74.3
v2.75.0
v2.75.1
v2.75.2
v2.75.3
v2.75.4
v2.75.5
v2.76.0
v2.76.1
v2.76.2
v2.77.0
v2.77.1
v2.78.0
v2.78.1
v2.79.0
v2.8.0
v2.8.1
v2.80.0
v2.81.0
v2.82.0
v2.83.0
v2.83.1
v2.84.0
v2.84.1
v2.85.0
v2.85.1
v2.86.0
v2.87.0
v2.87.1
v2.88.0
v2.88.1
v2.89.0
v2.89.1
v2.9.0
v2.9.1
v2.90.0
v2.91.0
v2.91.1
v2.91.2
v2.92.0
v2.92.1
v2.93.0
v2.94.0
v2.94.1
v2.94.2
v2.94.3
v2.94.4
v2.95.0
v2.95.1
v2.96.0
v2.97.0
v2.98.0
v2.99.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116018.json"