VULNpocalypse

CVE-2026-116018: ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users’ notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-10-24).

Weakness: Authorization Bypass Through User-Controlled Key

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing low privileges and no user interaction. Impact: confidentiality none, integrity low, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: GHSA-rq5g-4m5j-8p36

VEDAS cluster: VEDAS:DOVEDEEP

Exploit Observer links 3 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (3)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (2)

Catalogue entries, not exploit evidence.

3 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS
0.002
low predicted chance of attack
VEDAS
0.985
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Suricata

Who is affected

ProductAffectedNot affected
ONEARMY community-platformbefore 2.165.2Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 2.165.2.

Vendor guidance:

How to detect it

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-116018 ONEARMY community-platform - Notification Read IDOR. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-116018 ONEARMY community-platform - Notification Read IDOR"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/notifications/"; fast_pattern; nocase; content:"/read"; nocase; pcre:"/\x2fapi\x2fnotifications\x2f\d+\x2fread/i"; classtype:web-application-attack; reference:cve,CVE-2026-116018; reference:url,https://www.exploit.observer/?keyword=CVE-2026-116018&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=onearmy&match=exact; sid:1090203; rev:1;)

CVE-2026-116018.rules on GitHub

References

Vendor advisories and patches

Exploits and technical analysis

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.