CVE-2026-3111: Campus Educativa IDOR Vulnerability

CVE-2026-3111 Overview

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Campus Educativa at the endpoint /archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg (translated as 80x90 and 40x45). This vulnerability allows unauthenticated attackers to access profile photos of all users through URL manipulation, enabling mass collection of user photos without any authentication requirement.

Critical Impact

Successful exploitation enables attackers to harvest user profile photos en masse, which could be leveraged for identity impersonation, social engineering attacks, cross-platform identity linking via facial recognition, or doxxing campaigns.

Affected Products

• Campus Educativa (all versions with the vulnerable endpoint)

Discovery Timeline

• 2026-03-16 - CVE-2026-3111 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-3111

Vulnerability Analysis

This IDOR vulnerability exists due to improper access control on the user photo endpoint within Campus Educativa. The application fails to verify whether the requesting user has authorization to access specific user profile photos before serving the content. The endpoint /archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg accepts user identifiers directly in the URL path without performing any authentication or authorization checks.

The vulnerability is classified under CWE-284 (Improper Access Control), which encompasses scenarios where an application does not properly restrict access to resources from unauthorized actors. In this case, the photo resources are directly accessible to anyone who can craft the appropriate URL.

Root Cause

The root cause of this vulnerability is the absence of access control validation on the photo thumbnail endpoint. The application directly maps user IDs and usernames to file paths without verifying that the requester has permission to access the requested resource. This design flaw allows any user—authenticated or not—to enumerate user IDs and retrieve profile photos by simply modifying URL parameters.

Attack Vector

The attack vector leverages network access to the vulnerable endpoint. An attacker can exploit this vulnerability by:

1. Identifying the URL pattern for user profile photos (/archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg)
2. Enumerating user IDs sequentially or through other reconnaissance methods
3. Crafting requests with different ID values to retrieve profile photos
4. Automating the process to collect photos at scale

Since the endpoint accepts predictable parameters (numeric IDs and usernames), an attacker can iterate through possible values to harvest user photos without needing any credentials. The vulnerability supports both 80x90 and 40x45 thumbnail sizes, allowing attackers to obtain multiple resolution variants of each photo.

Detection Methods for CVE-2026-3111

Indicators of Compromise

• Unusual volume of requests to /archivos/usuarios/ endpoints from single IP addresses
• Sequential or pattern-based enumeration of user IDs in request logs
• Requests for user photos from IP addresses not associated with legitimate user sessions
• High-frequency access to thumbnail endpoints without corresponding authenticated sessions

Detection Strategies

• Implement rate limiting detection on the /archivos/usuarios/ endpoint to identify enumeration attempts
• Monitor for requests accessing multiple user photo resources from unauthenticated sessions
• Analyze web server logs for sequential ID patterns in requests to the vulnerable endpoint
• Deploy web application firewalls (WAF) with rules to detect IDOR enumeration behavior

Monitoring Recommendations

• Enable detailed logging for all requests to user photo endpoints including source IP, timestamp, and requested resource
• Set up alerts for anomalous access patterns such as high request volumes to photo endpoints
• Monitor for automated tool signatures in User-Agent strings accessing the vulnerable endpoint
• Implement session correlation to identify requests accessing photos without proper authentication context

How to Mitigate CVE-2026-3111

Immediate Actions Required

• Restrict access to the /archivos/usuarios/ endpoint to authenticated users only
• Implement authorization checks to verify users can only access their own photos or those they have permission to view
• Deploy rate limiting on photo endpoints to reduce the impact of enumeration attempts
• Consider temporarily disabling the vulnerable endpoint until a proper fix is implemented

Patch Information

Refer to the INCIBE CERT security advisory for official patch information and remediation guidance from the vendor.

Workarounds

• Implement server-side access control checks that validate user authorization before serving photo resources
• Replace predictable user IDs in URLs with non-guessable tokens or UUIDs
• Deploy authentication middleware on the affected endpoint to require valid session credentials
• Use indirect object references that map to actual resources only for authorized users
• Consider serving user photos through a separate authenticated API that validates permissions