Vulnerability · Published Aug 11, 2026 · Assigned by VulnCheck

CVE-2026-69115OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints

Medium 6.5

In plain English

A medium-severity missing authorization in OpenIM Server (open-im-server) from OpenIMSDK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.

Affected products (as reported)

Vendor	Product	Versions
OpenIMSDK	OpenIM Server (open-im-server)	0 – through 3.8.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Product Repository product
GitHub Issue issue-tracking
Patch Commit patch
Pull Request issue-tracking
https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpoints third-party-advisory