PT-2026-24816 · Comppolicylab+1 · Pingpong

Ekassos · Publicado 2026-03-11 · Atualizado 2026-03-16 · CVE-2026-32097

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PingPong versions prior to 7.27.2

Description PingPong is a platform designed for utilizing large language models (LLMs) in educational settings. An authenticated user could potentially retrieve or delete files beyond their authorized access scope. This could lead to the unauthorized access or removal of private files, including those uploaded by users and those generated by the model. Exploitation requires user authentication and specific permissions: viewing at least one thread is needed for retrieval, and participation in at least one thread is needed for deletion.

Recommendations Versions prior to 7.27.2 should be updated to version 7.27.2.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-32097

GHSA-4WWR-5WQ7-MGM4

Produtos afetados

Pingpong

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32097.json · Exploit
• https://github.com/comppolicylab/pingpong/security/advisories/GHSA-4wwr-5wq7-mgm4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32097 · Nota de Segurança
• https://t.me/cveNotify/155520 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-32097 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031867664239391177 · Publicação no Twitter