CVE-2026-82835: Django-Vue-Admin Auth Bypass Vulnerability

CVE-2026-82835 Overview

CVE-2026-82835 is an improper access control vulnerability [CWE-266] in caoqianming django-vue-admin 1.0. The flaw resides in the /api/file/ endpoint, where manipulation of the file_id argument bypasses access controls. An authenticated remote attacker can exploit the weakness over the network without user interaction. A public exploit exists, but the vendor did not respond to disclosure attempts. The issue affects file resource authorization, allowing unauthorized read or modification of file objects owned by other users.

Critical Impact

Authenticated remote attackers can access or manipulate file resources belonging to other users through the file_id parameter of /api/file/ in django-vue-admin 1.0.

Affected Products

• caoqianming django-vue-admin 1.0
• Deployments exposing the /api/file/ REST endpoint
• Downstream forks reusing the affected file access handler

Discovery Timeline

• 2026-08-31 - CVE-2026-82835 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82835

Vulnerability Analysis

The vulnerability is an improper access control flaw in the file management API of django-vue-admin 1.0. The /api/file/ endpoint accepts a file_id argument that identifies the target file record. The application resolves the identifier without validating whether the authenticated caller owns the resource or has been granted access. As a result, any low-privileged authenticated user can substitute another user's file_id and interact with the corresponding record. This behavior matches the classic Insecure Direct Object Reference pattern under [CWE-266] Incorrect Privilege Assignment.

Root Cause

The root cause is a missing authorization check between authentication and resource resolution. The file view resolves the object using the client-supplied identifier and returns it without cross-referencing the object owner or role permissions. Django REST Framework object-level permissions (get_object with check_object_permissions) are not enforced in the affected handler.

Attack Vector

An attacker first authenticates to the application using any valid low-privilege account. The attacker then enumerates or guesses sequential file_id values and submits requests to /api/file/ referencing files owned by other tenants. The server processes the request under the attacker's session and returns metadata or content bound to the referenced identifier. Public exploit material for this issue is available, lowering the barrier to exploitation. Full technical details are described in the VulDB entry for CVE-2026-82835.

Detection Methods for CVE-2026-82835

Indicators of Compromise

• Sequential or non-sequential enumeration of file_id values from a single authenticated session against /api/file/.
• HTTP 200 responses to /api/file/ requests where the requesting account is not the file owner recorded in the database.
• Spikes in file record reads correlated with a small set of source IP addresses or API tokens.

Detection Strategies

• Correlate application logs of /api/file/ accesses against the file ownership table to identify cross-user reads.
• Baseline normal per-user file access counts and alert on outliers accessing many distinct file_id values in a short window.
• Deploy a web application firewall rule to flag rapid iteration of the file_id query parameter.

Monitoring Recommendations

• Enable verbose audit logging on all Django REST Framework file views and forward logs to a centralized analytics platform.
• Monitor authentication tokens that suddenly access resources outside their historical scope.
• Alert on 4xx-to-2xx transitions on /api/file/ after file_id manipulation, which can indicate successful bypass attempts.

How to Mitigate CVE-2026-82835

Immediate Actions Required

• Restrict network exposure of /api/file/ to trusted networks until a patch is applied.
• Audit existing file access logs for evidence of file_id enumeration or cross-account reads.
• Rotate API tokens and session credentials for any account showing suspicious access patterns.
• Review user roles and remove unused accounts that could be leveraged for authenticated exploitation.

Patch Information

The vendor did not respond to disclosure attempts, and no official fix is referenced in the NVD entry. Operators should apply local patches that enforce object-level ownership checks in the affected file view. Track upstream activity on the caoqianming django-vue-admin repository for community patches, and consult the VulDB advisory for updates.

Workarounds

• Add a custom Django REST Framework permission class that verifies request.user matches the owner of the resolved File object before returning data.
• Override get_queryset in the affected view to filter files by the authenticated user, preventing lookups of other users' records.
• Introduce non-sequential identifiers such as UUIDs for file records to reduce enumeration feasibility, in combination with authorization checks.
• Place the API behind an authenticating reverse proxy that enforces per-tenant scoping until an upstream fix is available.

# Configuration example: enforce object-level ownership in django-vue-admin
# apps/files/permissions.py
from rest_framework import permissions

class IsFileOwner(permissions.BasePermission):
    def has_object_permission(self, request, view, obj):
        return obj.create_by_id == request.user.id

# apps/files/views.py
from rest_framework.viewsets import ModelViewSet
from .permissions import IsFileOwner

class FileViewSet(ModelViewSet):
    permission_classes = [permissions.IsAuthenticated, IsFileOwner]

    def get_queryset(self):
        return File.objects.filter(create_by=self.request.user)