~ / search / GHSA-r2jv-fwfr-4j8c

GHSA-r2jv-fwfr-4j8c

askbot inexhaustive permissions check allows any user to modify a different user's profile picture

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-1213

Packages

EcosystemPackageAffectedFixed in
PyPI askbot < 0.12.3 0.12.3

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users. This issue affects askbot: 0.12.2.

References

External links from the advisory. They lead to third-party sites.