PT-2026-4914 · Askbot · Askbot

Daniel Celis · Published 2026-01-27 · Updated 2026-04-07 · CVE-2026-1213

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions askbot versions prior to 0.12.2

Description An authenticated attacker with normal user permissions can modify the profile picture of other application users.

Recommendations Update to a version later than 0.12.2.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1213

GHSA-R2JV-FWFR-4J8C

Affected Products

Askbot

References · 9

• 🔥 https://fluidattacks.com/advisories/ghost · Exploit
• https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d · Patch
• https://osv.dev/vulnerability/CVE-2026-1213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1213 · Security Note
• https://osv.dev/vulnerability/GHSA-r2jv-fwfr-4j8c · Vendor Advisory
• https://github.com/askbot/askbot-devel · Note
• https://askbot.com · Note
• https://twitter.com/fluidattacks/status/2041624555350110416 · Twitter Post
• https://twitter.com/CVEnew/status/2016162501776351594 · Twitter Post