BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Impact
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 14.5.0Ecosystem versions | 14.5.0 |
Version evidence: OSV · GHSA-j3j5-5m8v-7gvc
View original version evidence (198 explicit versions)
Original source description
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2026-53673
- Patch github.com/buddypress/buddypress/commit/27d41e9749a878103b3a673b37dfc92b7f8f2cb7
- Source reference buddypress.org/
- Source reference github.com/buddypress/BuddyPress
- Source reference wordpress.org/plugins/buddypress
- Security advisory www.vulncheck.com/advisories/buddypress-private-message-idor-via-rest-api-user-id-parameter