CVE-2026-54050: Sakai CLE Auth Bypass Vulnerability

CVE-2026-54050 Overview

CVE-2026-54050 is a broken access control vulnerability [CWE-639] in Sakai, an open-source Collaboration and Learning Environment (CLE) used by universities and educational institutions. The flaw affects the profile management API in versions 23.0 through 23.4 and version 25.x prior to 25.3. An authenticated user can delete another user's profile image or pronunciation recording by supplying an arbitrary userId to the DELETE /api/users/{userId}/profile/image and DELETE /api/users/{userId}/profile/pronunciation endpoints. The endpoints do not verify ownership before invoking the delete operations.

Critical Impact

Any authenticated user can repeatedly remove profile identity artifacts belonging to other users, including administrators and instructors, disrupting workflows that depend on those artifacts.

Affected Products

• Sakai CLE versions 23.0 through 23.4
• Sakai CLE versions 25.0 through 25.2
• Sakai profile2 module (ProfileController, ProfileServiceImpl)

Discovery Timeline

• 2026-09-15 - CVE-2026-54050 published to the National Vulnerability Database (NVD)
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-54050

Vulnerability Analysis

The vulnerability resides in the Sakai profile2 REST API. The ProfileController.removeProfileImage() method accepts a userId path parameter and passes it directly to ProfileServiceImpl.removeProfileImage() without confirming that the requester owns the profile or holds administrative rights. The service layer then calls profileImageUploadedRepository.deleteById(userId), which removes the row identified by the attacker-supplied identifier.

The companion endpoint DELETE /api/users/{userId}/profile/pronunciation exhibits the same defect. It omits both session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's pronunciation recording. The upload endpoints are not affected because they already enforce ownership. Superusers remain intentionally authorized to modify other users' profiles.

Root Cause

The root cause is missing authorization on delete operations exposed by the profile REST controller. Existing ownership enforcement was present in upload code paths but was not applied to delete paths, producing an Insecure Direct Object Reference (IDOR) condition [CWE-639]. The patch centralizes the check in a new assertCanModifyProfile(String userUuid) method on ProfileService and invokes it from every mutation entry point.

Attack Vector

Exploitation requires only a valid authenticated session. An attacker sends an HTTP DELETE request to the vulnerable endpoint with the target user's UUID in the path. Because the operation is idempotent and cheap, an attacker can script repeated deletions to keep victims' profile images and pronunciation recordings removed as they are restored.

// Vulnerable pattern (pre-patch) in ProfileServiceImpl.setProfileImage
// showed the ownership check that was MISSING from remove* methods.
// The security patch replaces inline checks with a centralized helper:

@Override
public boolean saveUserProfile(ProfileTransferBean profileBean);

/**
 * Ensures the current user may modify the given user's profile.
 *
 * @param userUuid uuid of the profile to modify
 * @throws SecurityException if there is no session or the user is not allowed
 */
void assertCanModifyProfile(String userUuid);

// Refactored mutation path now delegates authorization:
@Override
public boolean setProfileImage(String userUuid, byte[] imageBytes,
                               String mimeType, String fileName) {
    String currentUserUuid = sakaiProxy.getCurrentUserId();
    checkCanModifyProfile(currentUserUuid, userUuid,
                          "update a user's profile image");
    // ...
}

Source: Sakai commit a092dbf3dc6bf343131f50007c207a9abd95e852

Detection Methods for CVE-2026-54050

Indicators of Compromise

• HTTP DELETE requests to /api/users/{userId}/profile/image or /api/users/{userId}/profile/pronunciation where the {userId} in the path differs from the authenticated session's user ID.
• Repeated 204/200 responses on the above endpoints from a single session targeting multiple distinct user IDs.
• Unexpected removal events for profile image or pronunciation records affecting administrator or instructor accounts.

Detection Strategies

• Enable HTTP access logging on the Sakai application server and alert when the path parameter user ID in profile delete requests does not match the authenticated principal.
• Instrument ProfileServiceImpl.removeProfileImage() and removePronunciationRecording() with audit logs capturing the caller UUID and the target UUID.
• Correlate database delete events on profileImageUploaded and pronunciation resource tables against the originating HTTP session identity.

Monitoring Recommendations

• Ingest Sakai web tier access logs and application audit logs into a centralized log platform for retention and anomaly detection.
• Baseline the normal rate of profile delete operations per user and alert on statistical outliers.
• Monitor for delete operations targeting privileged accounts (administrators, instructors) as high-priority events.

How to Mitigate CVE-2026-54050

Immediate Actions Required

• Upgrade Sakai to version 23.5, 25.3, or 26.0, which include the authorization fix.
• Audit recent HTTP access logs for DELETE requests against the profile image and pronunciation endpoints and identify affected users.
• Restore any inappropriately deleted profile identity artifacts from backups where possible.

Patch Information

The fix is delivered in Sakai versions 23.5, 25.3, and 26.0. The patch introduces ProfileService.assertCanModifyProfile(String userUuid), which throws SecurityException when the session is missing or the caller lacks rights, and it is now invoked from all profile mutation paths. See the GitHub Security Advisory GHSA-9284-fjc3-fmmj and the upstream commit for details.

Workarounds

• If patching cannot be performed immediately, block or restrict the DELETE /api/users/{userId}/profile/image and DELETE /api/users/{userId}/profile/pronunciation endpoints at a reverse proxy or web application firewall.
• Enforce a proxy rule that rejects DELETE requests to these endpoints when the path userId does not match the authenticated session user.
• Restrict access to the profile API to authenticated internal networks until patched.

# Example nginx rule to block cross-user profile deletes until patched.
# Requires the application to expose the session user via a header.
location ~ ^/api/users/(?<target_uid>[^/]+)/profile/(image|pronunciation)$ {
    if ($request_method = DELETE) {
        if ($http_x_sakai_current_user != $target_uid) {
            return 403;
        }
    }
    proxy_pass http://sakai_backend;
}