PT-2026-24816 · Comppolicylab+1 · Pingpong

Ekassos · Published 2026-03-11 · Updated 2026-03-16 · CVE-2026-32097

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PingPong versions prior to 7.27.2

Description PingPong is a platform designed for utilizing large language models (LLMs) in educational settings. An authenticated user could potentially retrieve or delete files beyond their authorized access scope. This could lead to the unauthorized access or removal of private files, including those uploaded by users and those generated by the model. Exploitation requires user authentication and specific permissions: viewing at least one thread is needed for retrieval, and participation in at least one thread is needed for deletion.

Recommendations Versions prior to 7.27.2 should be updated to version 7.27.2.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-32097

GHSA-4WWR-5WQ7-MGM4

Affected Products

Pingpong

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32097.json · Exploit
• https://github.com/comppolicylab/pingpong/security/advisories/GHSA-4wwr-5wq7-mgm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32097 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32097 · Vendor Advisory
• https://t.me/cveNotify/155520 · Telegram Post
• https://twitter.com/CVEnew/status/2031867664239391177 · Twitter Post