CVE-2026-116018Published
ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-116018 · Microsoft / collected KEV context
cve-program · CVE-2026-116018
- https://github.com/ONEARMY/community-platform/issues/5022
- https://github.com/ONEARMY/community-platform/pull/5011
- https://github.com/ONEARMY/community-platform/commit/571732c26caf1a0a46e5335d275cef2e19dfab08
- https://github.com/ONEARMY/community-platform/releases/tag/v2.165.2
- https://github.com/ONEARMY/community-platform/blob/v2.163.2/src/routes/api.notifications.$id.read.ts#L6-L22
- https://hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor
- https://www.vulncheck.com/advisories/onearmy-community-platform-before-2.165.2-idor-via-notification-read-endpoint
Related operational evidence
Explicit CVE identifiers- ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint · Newly collected advisory · 24 Oct 2026