Vulnerability · Published Oct 24, 2026 · Assigned by VulnCheck

CVE-2026-116018ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in community-platform from ONEARMY. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 88.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

Affected products (as reported)

Vendor	Product	Versions
ONEARMY	community-platform	0 – before 2.165.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/ONEARMY/community-platform/issues/5022 issue-tracking
https://github.com/ONEARMY/community-platform/pull/5011 patch, issue-tracking
https://github.com/ONEARMY/community-platform/commit/571732c26caf1a0a46e5335d275cef2e19dfab08 patch
community-platform v2.165.2 Release Notes release-notes
https://github.com/ONEARMY/community-platform/blob/v2.163.2/src/routes/api.notifications.$id.read.ts#L6-L22 technical-description
https://hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor third-party-advisory
VulnCheck Advisory: ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint third-party-advisory