PT-2026-38080 · Cisco · Slido

Rafal Golabek · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-20219

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Slido (affected versions not specified)

Description An insecure direct object reference in the REST API allows an authenticated remote attacker to access social profile data of other users or manipulate quiz and poll results by sending a crafted request to the vulnerable API endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-20219

Affected Products

Slido

References · 3

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-slido-idor-CpsFmKxN · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20219 · Security Note
• https://twitter.com/CVEnew/status/2052086710683775317 · Twitter Post