CVE-2026-85210 oppia CVE debrief

Who should care

Defenders and administrators of Oppia systems should assess exposure to this vulnerability and prioritize mitigation, especially in systems where unauthorized access to sensitive information could have significant consequences.

Why it matters

CVE-2026-85210 is a medium-severity vulnerability in Oppia's AdminRoleHandler GET endpoint that allows unauthorized enumeration of privileged accounts and roles. Defenders should prioritize verifying and mitigating exposure to this vulnerability, especially in systems where unauthorized access to sensitive information could have significant consequences.

• Defenders should verify and mitigate exposure to unauthorized access to sensitive information.
• Systems with sensitive information may be at risk of unauthorized access.
• Defenders should review and update access controls for the AdminRoleHandler GET endpoint.

Technical summary

The AdminRoleHandler GET endpoint in Oppia's core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization. This vulnerability allows defenders to verify and mitigate exposure, especially in systems where unauthorized access to sensitive information could have significant consequences. Affected product deployments should be confirmed in managed environments, and owners should be assigned for follow-up. The official CVE Program record and NIST NVD detail page provide additional information about the vulnerability, including its description, CVSS score, and affected systems. However, verification from official sources is required to establish versions, exploitation, impact, or remediation. To prevent unauthorized access, defenders should review and update access controls for the AdminRoleHandler GET endpoint. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested, with the item only closed after evidence is documented. This vulnerability has a medium severity and a CVSS score of 5.3. The CVE record was published on 2026-09-03T15:17:40.103Z and has not been modified since then. The NVD entry provides additional details about the vulnerability, including its description and affected systems. However, further verification is required to establish the full impact of the vulnerability. To address this vulnerability, defenders should prioritize verifying and mitigating exposure, especially in systems where unauthorized access to sensitive information could have significant consequences. This can be achieved by reviewing and updating access controls, monitoring for potential exploitation attempts, and implementing compensating controls as needed. Additionally, defenders should review and update access controls for the

Defensive priority

Defenders should prioritize verifying and mitigating exposure to this vulnerability, especially in systems where unauthorized access to sensitive information could have significant consequences.

Recommended defensive actions

• Verify and mitigate exposure to this vulnerability, especially in systems where unauthorized access to sensitive information could have significant consequences.
• Review and update access controls for the AdminRoleHandler GET endpoint to prevent unauthorized access.
• Monitor for potential exploitation attempts and implement compensating controls as needed.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected systems. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.