CVE-2026-71854

{
  "etk_id": "ETK-2026-1623",
  "cve_id": "CVE-2026-71854",
  "display_id": "CVE-2026-71854",
  "ghsa_id": "GHSA-47wr-wp4h-8v3f",
  "euvd_id": "EUVD-2026-101628",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in OpenAEV lessons API",
  "summary": "OpenAEV releases before 2.260622.0 leave the player lessons API insufficiently protected on default installations. An unauthenticated party that knows an exercise UUID can view lesson questions and responses and can change responses in another user's name.",
  "mitigation": "Upgrade OpenAEV to version 2.260622.0 or later. Until the upgrade is complete, restrict network access to the player lessons endpoints to trusted users and systems.",
  "vendor": "OpenAEV-Platform",
  "product": "openaev",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "2.260604.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.260622.0"
      ],
      "package_name": "openaev-api/src/main/java/io/openaev/rest/lessons/ExerciseLessonsApi.java (OpenAEV)",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
  "epss_score": 0.0025,
  "epss_percentile": 0.1479,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 62.299895416666665,
  "t0_at": "2026-10-14T20:05:05.232000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-16T04:29:55.804406+00:00",
      "days": 1.3505853287731482,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T20:05:05.232000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-09-18T15:34:40+00:00",
      "days": -26.18779203703704,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T20:05:05.232000+00:00",
      "url": "https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-47wr-wp4h-8v3f"
    },
    "trigger_signal": {
      "at": "2026-10-14T20:05:05.232000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T20:05:05.232000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71854"
    }
  }
}