Description

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T19:18:42.093Z",
  "pubdate": "2026-08-11T19:18:42.093Z",
  "executiveSummary": "OpenIM Server v3.8.3 contains a missing authorization vulnerability that enables authenticated standard users to execute administrative management API operations. The flaw stems from an absence of proper access control validation within specific endpoint handlers. By submitting crafted POST requests using a standard user bearer token, low-privileged threat actors can query endpoints restricted to administrative personnel. The primary impact involves the unauthorized exposure of sensitive platform telemetry, including the complete enumeration of all user accounts, userIDs, nicknames, manager level flags, and global group configurations. This includes access to private groups that the querying user has never joined, thereby disclosing internal group names, owner IDs, and precise member counts. The risk implications are significant for enterprise deployments relying on strict data segregation and multi-tenancy protections, as malicious actors with basic user credentials can harvest internal organizational directories. Exploitation requires minimal attacker capabilities, specifically a valid authenticated user session token, and relies on network reachability to the exposed API routes without necessitating complex exploit payloads or prior administrative privilege escalation.",
  "technicalDetails": "The root cause of the vulnerability resides in the omission of the authverify.CheckAdmin() security enforcement function within specific backend route handlers of OpenIM Server v3.8.3. Specifically, the affected vulnerable components include the GetPaginationUsers, GetAllUserID, and GetGroups handlers, which govern access to critical administrative management endpoints. In secure software architecture, these administrative routines must evaluate incoming JSON Web Tokens or session credentials against explicit authorization policies to verify that the requesting principal holds the necessary administrative or manager role.\nBecause this verification check is absent in the target functions, the application fails to validate the privilege level associated with the supplied bearer token during POST requests. Consequently, any authenticated user can successfully query the restricted endpoints: /user/get_users, /user/get_all_users_uid, and /group/get_groups. The attack flow proceeds as follows: an attacker establishes a baseline standard user account to obtain a valid authentication bearer token via normal registration or login workflows. The attacker then crafts an HTTP POST request targeting one of the vulnerable endpoints.\nUpon receiving the payload, the server authenticates the session to confirm the user exists within the system, but bypasses the critical authorization gate that checks for administrative privileges. The server processes the request and returns comprehensive data payloads containing unauthorized information. Post-exploitation impact and payload behavior allow malicious actors to systematically scrape the entire user database and internal group topologies. This exposes sensitive metadata such as userIDs, user nicknames, manager level status flags, private group identifiers, owner IDs, and total member counts. The vulnerability is exploitable over standard network protocols wherever the OpenIM Server API is exposed, lowering the barrier for reconnaissance phases in advanced cyber attacks against targeted organizational communication infrastructure."
}