CVE-2026-20219: Cisco Slido Information Disclosure Flaw

CVE-2026-20219 Overview

CVE-2026-20219 is an Insecure Direct Object Reference (IDOR) vulnerability in the REST API of Cisco Slido. An authenticated, remote attacker could exploit the flaw by sending a crafted request to a vulnerable API endpoint. Successful exploitation allowed the attacker to access social profile data of other users or alter quiz and poll results. Cisco has addressed the vulnerability in the Slido service, and no customer action is required. The issue is tracked under [CWE-639] and is published in the Cisco Security Advisory.

Critical Impact

An authenticated attacker could read other users' social profile data and manipulate quiz and poll outcomes through the Slido REST API.

Affected Products

• Cisco Slido (cloud-hosted service)
• Slido REST API endpoints handling user profile resources
• Slido REST API endpoints handling quiz and poll resources

Discovery Timeline

• 2026-05-06 - CVE-2026-20219 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-20219

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the Cisco Slido REST API. The API exposed object identifiers referencing user-owned resources without enforcing per-user authorization on each request. An authenticated attacker who substituted another user's identifier in an API call received that user's data in response. The same authorization gap allowed write operations against quiz and poll resources owned by other sessions, enabling tampering with audience interaction results.

Because exploitation requires only valid Slido authentication, any participant or registered user could request resources outside their own scope. The flaw breaks the integrity of audience polling outcomes and exposes social profile attributes intended to be visible only to their owners.

Root Cause

The REST API trusted client-supplied object identifiers without verifying that the authenticated principal owned or had rights to the referenced object. This is a classic missing object-level authorization check, mapped to [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

The attack vector is network-based and requires authentication. An attacker authenticates to Slido, observes the structure of REST API requests, and replaces identifiers such as user, profile, quiz, or poll IDs with values belonging to other tenants or sessions. The API then returns data or accepts modifications that should be denied. No user interaction is required from the victim. See the Cisco Security Advisory for the official description. Cisco has not published verified exploit code, and no public proof-of-concept is available.

Detection Methods for CVE-2026-20219

Indicators of Compromise

• Anomalous quiz or poll result changes that do not correlate with legitimate participant activity in event logs.
• Unexpected access to user social profile fields by accounts that did not initiate profile lookups through the Slido user interface.
• Bursts of REST API requests from a single authenticated session iterating numeric or sequential object identifiers.

Detection Strategies

• Review Slido administrative audit trails for profile reads and poll modifications attributed to unexpected user identifiers.
• Correlate API request patterns with session metadata to identify identifier enumeration against /users, /polls, or /quizzes style endpoints.
• Compare expected event participant rosters with accounts performing privileged read or write operations.

Monitoring Recommendations

• Forward Slido access and audit logs to a centralized logging platform for retention and analysis.
• Alert on high request rates from a single session against object-keyed REST endpoints.
• Track integrity of poll and quiz tallies by snapshotting results at event close and comparing against historical baselines.

How to Mitigate CVE-2026-20219

Immediate Actions Required

• Confirm the Slido tenant is operating on the current cloud release; Cisco has remediated the issue server-side and no customer upgrade is required.
• Review historical event audit logs for unauthorized profile access or poll tampering during the exposure window.
• Rotate any administrative API tokens that were used during periods of suspected misuse.

Patch Information

Cisco has remediated CVE-2026-20219 in the Cisco Slido service. Because Slido is delivered as a SaaS product, the fix has been applied centrally and no customer action is needed. Refer to the Cisco Security Advisory cisco-sa-slido-idor-CpsFmKxN for the authoritative remediation statement.

Workarounds

• No customer-side workaround is required because Cisco has fixed the vulnerability in the hosted Slido service.
• Restrict Slido administrative accounts to least privilege and enforce single sign-on with multi-factor authentication to limit residual abuse of legitimate sessions.
• For high-stakes events, validate poll and quiz results against an out-of-band tally where feasible.