CVE-2026-71854
Description
A flaw was found in openaev. The player application programming interface (API) endpoints do not enforce authentication and trust user-supplied parameters without verifying access permissions. An unauthenticated remote attacker with knowledge of an exercise identifier can exploit this flaw to view sensitive lessons-learned questions, answers, and participant identities, or submit and modify answers on behalf of arbitrary users.
Statement
Red Hat Product Security rates this vulnerability as Important because unauthenticated remote attackers can retrieve sensitive assessment results and forge participant responses without requiring user credentials. Exploitation requires knowledge of a targeted exercise identifier to interact with the unprotected interface. OpenAEV is not packaged or supported in Red Hat products, and default Red Hat environments are not affected.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
