GitHub Advisoryadvisory · PyPI

GHSA-r2jv-fwfr-4j8c askbot inexhaustive permissions check allows any user to modify a different user's profile picture

MEDIUM Published 2026-01-27 Modified 2026-01-28 Official page ↗
Aliases
CVE-2026-1213
Ecosystem
PyPI
Packages
askbot
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-639
Reviewed
2026-01-28

Affected packages

• PyPI askbot: < 0.12.3 → fixed in 0.12.3

Description

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users. This issue affects askbot: 0.12.2.

Related

Alias · CVE (1)

  • CVE-2026-1213 All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References