Description
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
Problem types
Authorization Bypass Through User-Controlled Key
Product status
Credits
Scott Moore - VulnCheck
References
buddypress.org/
wordpress.org/plugins/buddypress/
www.vulncheck.com/...age-idor-via-rest-api-user-id-parameter (VulnCheck Advisory: BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter)