CVE-2026-32736: Hytale Modding Wiki IDOR Vulnerability

CVE-2026-32736 Overview

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation and wikis. An Insecure Direct Object Reference (IDOR) vulnerability in versions of the wiki prior to 1.0.0 exposes mod authors' personal information - including full names and email addresses - to any authenticated user who visits a mod page. Any user who creates an account can access sensitive author details by simply navigating to a mod's page via its slug.

Critical Impact

Authenticated users can access sensitive personal information of mod authors, including full names and email addresses, leading to potential privacy violations and enabling further targeted attacks.

Affected Products

• Hytale Modding Wiki versions prior to 1.0.0

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-32736 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32736

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when a software component does not perform an authorization check when an actor attempts to access a resource or perform an action. In the case of the Hytale Modding Wiki, the application fails to properly restrict access to sensitive mod author data, allowing any authenticated user to retrieve personally identifiable information (PII) that should be protected.

The vulnerability requires only low-privilege access - a simple authenticated account is sufficient to exploit this flaw. The attack can be conducted remotely over the network without any user interaction required, making it trivially exploitable for any registered user of the platform.

Root Cause

The root cause of this vulnerability lies in the lack of proper authorization checks within the ModController.php and PageController.php files. When rendering mod pages, the application serializes and exposes the complete user object data for mod authors without filtering out sensitive fields. This means that personally identifiable information such as full names and email addresses is inadvertently included in the response payload accessible to any authenticated visitor.

Attack Vector

The attack is straightforward: an attacker simply needs to create an account on the Hytale Modding Wiki platform and navigate to any mod page using its URL slug. The application returns the full author object data in the response, which includes sensitive PII that should not be exposed to regular users. No special tools or techniques are required beyond basic authentication and standard HTTP requests.

// Security patch in app/Http/Controllers/ModController.php
// Source: https://github.com/HytaleModding/wiki/commit/4a96b3f9bce9a9d34030c39a8d6e4c6b6183f13d

 use App\Models\Mod;
 use App\Models\ModInvitation;
 use App\Models\User;
+use Illuminate\Contracts\Pagination\LengthAwarePaginator;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Mail;

// Security patch in app/Http/Controllers/PageController.php
// Source: https://github.com/HytaleModding/wiki/commit/4a96b3f9bce9a9d34030c39a8d6e4c6b6183f13d

 
 use App\Models\Mod;
 use App\Models\Page;
+use App\Models\User;
 use App\Services\PageViewService;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;

Detection Methods for CVE-2026-32736

Indicators of Compromise

• Unusual patterns of sequential mod page access by single authenticated users
• High volume of API requests to mod page endpoints from individual accounts
• Requests that appear to be enumerating or scraping author information across multiple mod pages

Detection Strategies

• Monitor authentication logs for accounts accessing an abnormally high number of mod pages in short time periods
• Implement rate limiting on mod page endpoints and alert on threshold violations
• Review application logs for patterns suggesting automated data harvesting from mod author profiles

Monitoring Recommendations

• Enable detailed request logging for endpoints serving mod page data
• Set up alerts for bulk access patterns that may indicate PII harvesting attempts
• Audit user account creation patterns for potential abuse accounts created specifically to exploit this vulnerability

How to Mitigate CVE-2026-32736

Immediate Actions Required

• Upgrade to Hytale Modding Wiki version 1.0.0 or later immediately
• Review access logs to identify any potential exploitation of this vulnerability
• Notify affected mod authors that their personal information may have been exposed to other authenticated users

Patch Information

Version 1.0.0 of the Hytale Modding Wiki addresses this vulnerability by properly serializing page owner data to exclude sensitive fields. The fix modifies the ModController.php and PageController.php files to ensure that only necessary, non-sensitive user data is exposed in mod page responses. For full technical details, refer to the GitHub Security Advisory GHSA-xvq7-wwhx-x2fh and the security patch commit.

Workarounds

• If immediate patching is not possible, consider temporarily restricting account creation or authentication to trusted users only
• Implement additional application-layer access controls to filter sensitive user data from API responses
• Consider temporarily taking the service offline if sensitive author data exposure is unacceptable until the patch can be applied

# Configuration example - Upgrade to patched version
cd /path/to/hytale-wiki
git fetch origin
git checkout v1.0.0
composer install --no-dev
php artisan migrate
php artisan cache:clear