CVE-2026-84430: gouguoa RCE Vulnerability via Object Injection

CVE-2026-84430 Overview

CVE-2026-84430 affects gouguoa Office versions up to 5.10.0 and 6.0.1. The vulnerability resides in the update function of app/home/controller/Index.php, part of the edit_personal endpoint. Manipulation of the position_id parameter enables dynamically-determined object attributes [CWE-913], allowing an authenticated remote attacker to influence application object state. The exploit has been publicly disclosed. Upgrading to version 6.0.3 resolves the issue.

Critical Impact

An authenticated remote attacker can manipulate object attributes through the position_id parameter, potentially affecting confidentiality, integrity, and availability of the affected application.

Affected Products

• gouguoa Office up to and including version 5.10.0
• gouguoa Office version 6.0.1
• Component: app/home/controller/Index.php (edit_personal endpoint)

Discovery Timeline

• 2026-09-02 - CVE-2026-84430 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84430

Vulnerability Analysis

The vulnerability originates in the update function inside app/home/controller/Index.php. The edit_personal endpoint accepts a user-supplied position_id argument and uses it to dynamically determine object attributes at runtime. This pattern maps directly to CWE-913: Improper Control of Dynamically-Managed Code Resources.

An authenticated attacker can supply crafted values for position_id to influence which object properties are read or written during the update flow. Because the attribute name itself is derived from attacker-controlled input, the attacker can reach fields that were not intended to be user-modifiable through this endpoint.

The attack is remotely executable over the network and requires only low-privilege authentication. A public exploit has been disclosed, increasing the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is the direct use of user-controlled input as an object attribute selector without an allowlist. The update function trusts the position_id parameter to safely map to an internal property, but no validation restricts which attributes can be reached or overwritten.

Attack Vector

Exploitation requires an authenticated session and network access to the vulnerable web endpoint. The attacker submits a modified request to the edit_personal handler with a crafted position_id value. The application then applies the update against an attacker-selected attribute of the target object.

No verified exploit code is published for reproduction here. Technical details are referenced in the GitHub CVE Documentation and the VulDB CVE-2026-84430 entry.

Detection Methods for CVE-2026-84430

Indicators of Compromise

• HTTP POST requests to the edit_personal endpoint containing unexpected or non-numeric values in the position_id parameter.
• Unexplained modifications to user profile records or object attributes not typically exposed by the update flow.
• Repeated update calls from a single authenticated session enumerating different position_id values.

Detection Strategies

• Inspect application and web server logs for requests to app/home/controller/Index.php with anomalous position_id payloads.
• Baseline legitimate position_id value patterns and alert on deviations such as string values, attribute-name-like tokens, or overly long inputs.
• Correlate authentication events with subsequent edit_personal activity to identify low-privilege accounts touching administrative attributes.

Monitoring Recommendations

• Enable verbose logging on the update function and the edit_personal endpoint, capturing full request bodies.
• Monitor database write patterns for unexpected columns being updated by the Index controller.
• Alert on version banners indicating gouguoa Office 5.10.0 or 6.0.1 remain deployed after the patch window.

How to Mitigate CVE-2026-84430

Immediate Actions Required

• Upgrade gouguoa Office to version 6.0.3 or later, available from the Gitee Office Release v6.0.3 page.
• Inventory internal deployments and identify any instances running 5.10.0, 6.0.1, or earlier.
• Restrict network exposure of the affected application to trusted users while patching is in progress.

Patch Information

The vendor addressed CVE-2026-84430 in version 6.0.3. Administrators should apply this release to eliminate the dynamically-determined object attribute condition in the edit_personal endpoint. Release artifacts are published at the Gitee Office Release v6.0.3 page.

Workarounds

• Apply a web application firewall rule that rejects requests to the edit_personal endpoint containing non-numeric or unexpected position_id values.
• Enforce strict server-side allowlisting of updatable attributes in the update function if patching cannot be performed immediately.
• Reduce the number of low-privilege accounts able to reach the vulnerable endpoint until the upgrade is complete.