CVE-2026-1213 MEDIUM

CVE-2026-1213: Askbot 0.12.2 - Insecure Direct Object Reference (IDOR)

Vendor Askbot

Product askbot

Weakness CWE-639 · IDOR

Published January 27, 2026

Last update January 27, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.

Key dates

02Disclosure timeline

January 27, 2026 CVE published

January 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1213 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2026-9185 6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter CVE-2025-41098 Insecure Direct Object Reference in GPS BOLD Workplanner CVE-2025-61950 CVE-2026-3568 MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update CVE-2023-48304 Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user