CyberRota Analysis
AI-GeneratedThe AdminRoleHandler GET endpoint in Oppia's core/controllers/admin.py is vulnerable, allowing any registered user to enumerate privileged accounts and roles due to improper access controls. This exposure enables attackers to retrieve sensitive information, such as usernames, banned flags, and managed topic identifiers, without authorization. Organizations using Oppia should prioritize addressing this vulnerability to mitigate the risk of unauthorized access to sensitive user information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.