Is CVE-2026-108164 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108164?

CVE-2026-108164 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-108164

Description

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.