CVE-2026-69115: OpenIM Server Auth Bypass Vulnerability

CVE-2026-69115 Overview

CVE-2026-69115 is a missing authorization vulnerability [CWE-862] in OpenIM Server v3.8.3. Any authenticated user can invoke admin-only management endpoints by sending POST requests with a standard user bearer token. The affected routes are /user/get_users, /user/get_all_users_uid, and /group/get_groups. The GetPaginationUsers, GetAllUserID, and GetGroups handlers omit the authverify.CheckAdmin() call, allowing regular users to enumerate every account and group on the platform. Exposed data includes user IDs, nicknames, manager level flags, group names, owner IDs, and member counts, including private groups the requester never joined.

Critical Impact
A low-privileged authenticated user can enumerate all platform users and all groups, including private groups, leaking identity metadata usable for follow-on social engineering and account targeting.

Affected Products

OpenIM Server v3.8.3
Deployments exposing the OpenIM management API to authenticated tenants
Downstream products embedding the vulnerable internal/rpc/user and internal/rpc/group handlers

Discovery Timeline

2026-08-11 - CVE-2026-69115 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-69115

Vulnerability Analysis

The vulnerability sits in OpenIM's RPC layer for user and group queries. Three handlers responsible for privileged enumeration, GetPaginationUsers, GetAllUserID, and GetGroups, do not verify that the caller holds an administrator role. The API gateway forwards any valid bearer token to these RPC methods, so a normal chat user obtains the same response an administrator would receive.

Enumeration through /user/get_users returns paginated user records containing userID, nickname, and the globalRecvMsgOpt and manager level fields. /user/get_all_users_uid returns the full list of user identifiers. /group/get_groups returns every group document on the server, including private groups where the caller has no membership. Attackers can build a full directory of the tenant, including group ownership graphs and member counts, without triggering additional authentication.

Root Cause

The root cause is a missing authorization check. The patched handlers add a call into github.com/openimsdk/open-im-server/v3/pkg/authverify to gate the operation on administrator identity. The pre-patch code path invoked the underlying database query directly and returned results to any authenticated caller.

Attack Vector

Exploitation requires network access to the OpenIM API and a valid user bearer token, which any registered account provides. The attacker issues POST requests to the three endpoints and paginates through the responses. No user interaction, elevated privilege, or client-side flaw is required.

// Security patch in internal/rpc/user/user.go
// fix(core): enforce admin access for queries (#3781)
 	"sync"
 	"time"

+	"google.golang.org/grpc"
+
 	"github.com/openimsdk/open-im-server/v3/internal/rpc/relation"
 	"github.com/openimsdk/open-im-server/v3/pkg/authverify"
 	"github.com/openimsdk/open-im-server/v3/pkg/common/config"

Source: GitHub Commit 193870b

// Security patch in internal/rpc/group/group.go
// fix(core): enforce admin access for queries (#3781)
 	"strings"
 	"time"

-	"github.com/openimsdk/tools/utils/stringutil"
 	"google.golang.org/grpc"

+	"github.com/openimsdk/tools/utils/stringutil"
+
 	"github.com/openimsdk/open-im-server/v3/pkg/dbbuild"
 	"github.com/openimsdk/open-im-server/v3/pkg/rpcli"

Source: GitHub Commit 193870b. The commit imports authverify into the user RPC package and reorganizes group RPC imports as part of adding authverify.CheckAdmin() guards on the affected handlers.

Detection Methods for CVE-2026-69115

Indicators of Compromise

Successful HTTP 200 responses to POST /user/get_users, /user/get_all_users_uid, or /group/get_groups originating from non-administrator accounts.
Bearer tokens tied to regular user IDs generating high-volume paginated queries against user or group listing endpoints.
Egress spikes from OpenIM API pods correlated with a single low-privilege session ID.

Detection Strategies

Parse OpenIM gateway access logs and alert when userID claims lacking the administrator role hit the three enumeration paths.
Baseline normal client request volumes to /user/* and /group/* and flag statistical outliers by session token.
Add a WAF or reverse-proxy rule that rejects requests to the three endpoints unless the JWT contains an administrator claim.

Monitoring Recommendations

Ingest OpenIM API logs into a central analytics pipeline and retain full request metadata for at least 90 days.
Track pagination cursor progression per token to identify sequential enumeration behavior.
Correlate authentication events with subsequent API access to surface newly created accounts that immediately query directory endpoints.

How to Mitigate CVE-2026-69115

Immediate Actions Required

Upgrade OpenIM Server to a release that includes commit 193870b2f938278b27a2d8347bd7e4db5f8f9dfc from pull request #3781.
Restrict network exposure of the OpenIM management API to trusted administrator networks until the patch is applied.
Rotate bearer tokens for any account observed calling the affected endpoints from non-administrative contexts.

Patch Information

The upstream fix adds authverify.CheckAdmin() guards to GetPaginationUsers, GetAllUserID, and GetGroups. Apply the merged fix from the OpenIM SDK repository (openimsdk/open-im-server) referenced in the VulnCheck advisory and tracked in issue #3778.

Workarounds

Place an authenticating reverse proxy in front of OpenIM that rejects /user/get_users, /user/get_all_users_uid, and /group/get_groups unless the caller is verified as an administrator.
Segment the API network so only administrative tooling can reach the management endpoints.
Disable or block the three routes at the ingress layer if administrative enumeration is not required by the deployment.

bash

# Example NGINX ingress rule blocking non-admin access to affected routes
location ~ ^/(user/get_users|user/get_all_users_uid|group/get_groups)$ {
    if ($http_x_user_role != "admin") {
        return 403;
    }
    proxy_pass http://openim_api_upstream;
}