Is CVE-2026-85210 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85210?

CVE-2026-85210 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-85210

Description

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.