CVE-2026-85210
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Sep 03, 2026
Vendor
unknown
Description
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.