PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-116018 ONEARMY CVE debrief

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

Vendor
ONEARMY
Product
community-platform
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-24
Original CVE updated
2026-10-29
Advisory published
2026-10-24
Advisory updated
2026-10-29

Who should care

Defenders responsible for the ONEARMY community-platform deployment should assess exposure and apply the vendor-provided patch to prevent potential suppression of unread indicators.

Why it matters

Defenders should prioritize verifying exposure and applying the vendor-provided patch to prevent potential suppression of unread indicators in the ONEARMY community-platform before 2.165.2.

  • Potential suppression of unread indicators for users in the same tenant
  • Authenticated users can iterate sequential notification IDs to access other users' notifications

Technical summary

The ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. This vulnerability can be exploited by attackers to suppress unread indicators of users in the same tenant, causing them to miss replies, comments, and new-content notices. Defenders should prioritize verifying exposure and applying the vendor-provided patch to prevent potential suppression of unread indicators.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor-provided patch to prevent potential suppression of unread indicators.

Recommended defensive actions

  • Verify exposure by checking if the community-platform version is before 2.165.2
  • Apply the vendor-provided patch to prevent potential suppression of unread indicators
  • Monitor for potential abuse of the notification read endpoint
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor-provided information. Defenders should verify exposure and apply the vendor-provided patch to prevent potential suppression of unread indicators. Evidence is limited to CVE and NVD,

Sources and references

Verified primary and authoritative sources

  • CVE-2026-116018 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-116018

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-116018 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-116018

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116018.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/ONEARMY/community-platform/issues/5022

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/ONEARMY/community-platform/pull/5011

    Supplemental source - patch, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/ONEARMY/community-platform/commit/571732c26caf1a0a46e5335d275cef2e19dfab08

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/ONEARMY/community-platform/releases/tag/v2.165.2

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/ONEARMY/community-platform/blob/v2.163.2/src/routes/api.notifications.$id.read.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/onearmy-community-platform-before-2.165.2-idor-via-notification-read-endpoint

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.