PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111722 LingGuoAI CVE debrief

CVE-2026-111722 is an insecure direct object reference vulnerability in LingGuo-Drama through commit 8a6924a, allowing registered users to access other users' projects via the /admin/v1/projects/:id API. The vulnerability exists because projects.Get lacks an owner check, enabling self-registered attackers to iterate numeric IDs to read, overwrite, reassign, or delete any user's short-drama projects.

Vendor
LingGuoAI
Product
LingGuo-Drama
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-16
Advisory published
2026-10-16
Advisory updated
2026-10-16

Who should care

Defenders responsible for LingGuo-Drama installations, especially those with untrusted users accessing the /admin/v1/projects/:id API, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-111722 is a high-severity vulnerability in LingGuo-Drama that allows registered users to access and modify other users' projects due to a lack of owner checks in the /admin/v1/projects/:id API. Defenders should prioritize verifying exposure and implementing remediation measures.

  • Defenders must verify exposure of LingGuo-Drama installations to this vulnerability.
  • Unrestricted access to the /admin/v1/projects/:id API can lead to unauthorized project modifications.
  • Remediation requires implementing owner checks for projects.Get and restricting API access.

Technical summary

The vulnerability exists in LingGuo-Drama through commit 8a6924a, where the projects.Get function lacks an owner check, allowing registered users to access other users' projects via the /admin/v1/projects/:id API. This insecure direct object reference vulnerability enables self-registered attackers to iterate numeric IDs to read, overwrite, reassign, or delete any user's short-drama projects. Defenders should prioritize verifying exposure of LingGuo-Drama installations to this vulnerability, especially in environments where untrusted users have access to the /admin/v1/projects/:id API. Implementing owner checks for projects.Get and restricting API access are crucial remediation measures.

Defensive priority

Defenders should prioritize verifying exposure of LingGuo-Drama installations to this vulnerability, especially in environments where untrusted users have access to the /admin/v1/projects/:id API.

Recommended defensive actions

  • Verify exposure of LingGuo-Drama installations to this vulnerability
  • Restrict access to the /admin/v1/projects/:id API to authorized users
  • Implement owner checks for projects.Get
  • Monitor for suspicious activity on the /admin/v1/projects/:id API
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in LingGuo-Drama through commit 8a6924a and the lack of an owner check in projects.Get. However, specific details on affected versions, exploitation, and remediation are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111722 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111722

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111722 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111722

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111722.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/lingguo-drama-broken-access-control

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/models/projects/projects_utils.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/http/controllers/admin/v1/projects_controller.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/routes/admin.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/lingguo-drama-through-commit-8a6924a-idor-via-admin-v1-projects-id-api

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.