Description

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-03T15:17:40.103Z",
  "pubdate": "2026-09-03T15:17:40.103Z",
  "executiveSummary": "The vulnerability resides in the AdminRoleHandler GET endpoint within Oppia, categorized as an Improper Access Control flaw. This security defect allows any registered user to bypass intended authorization constraints, enabling the unauthorized enumeration of sensitive administrative data.\nBy interacting with the affected endpoint, an attacker can extract a list of users holding privileged roles, identify accounts flagged as banned, and retrieve identifiers associated with managed topics. The vulnerability arises from an overly permissive access decorator, open_access, applied to a controller that processes sensitive system-wide information.\nThe impact is significant, as it facilitates reconnaissance against the platform's user base and administrative structure. This information disclosure provides adversaries with the necessary intelligence to identify high-value targets for further exploitation, such as social engineering or targeted account takeovers. The attack requires only a registered user account, necessitating no elevated privileges to initiate the enumeration process. The exposure is internal to the application's authenticated ecosystem, representing a failure in the principle of least privilege for sensitive administrative backend controllers.",
  "technicalDetails": "The root cause of this vulnerability is the inappropriate application of the open_access decorator to the AdminRoleHandler controller, located in core/controllers/admin.py. In the Oppia architecture, the open_access decorator is designed for public-facing endpoints; however, its implementation on a handler intended for administrative oversight leads to a total bypass of the server-side authorization checks typically required to guard privileged information.\nThe vulnerability manifests through the handling of the filter_criterion query parameter. The endpoint is designed to accept filtering criteria that enable administrators to search for users based on their role assignments, ban status, or specific topic management capabilities. Because the controller lacks secondary authorization validation within the method body, it blindly accepts these requests from any authenticated session and executes database queries to retrieve the requested user metadata.\nThe attack flow proceeds as follows: First, an attacker authenticates as a standard user within the Oppia platform. Second, the attacker sends a crafted GET request to the AdminRoleHandler endpoint. By manipulating the filter_criterion parameters, the attacker can iteratively query the underlying data store for specific administrative roles (e.g., 'admin', 'moderator'). The backend subsequently parses these parameters, executes the relevant query, and returns a serialized response containing usernames, role assignments, and managed topic IDs associated with those criteria.\nThis enumeration capability grants an attacker full visibility into the administrative hierarchy of the application. The exploitation is stateless and does not require elevated privileges, as the system treats the requester as authorized due to the bypass created by the open_access decoration. The post-exploitation impact includes the identification of privileged user IDs, which can then be utilized to perform more targeted attacks. By mapping the 'banned' status of users, an attacker may also gain insight into the platform's moderation history and current enforcement activities. The flaw persists throughout the codebase where this controller is active, and because it resides in the core controller logic, it is accessible over the network to any user with a valid platform session."
}