{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/lingguo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lingguo:drama:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-111722"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Drama (through commit 8a6924a)"],"_cs_severities":["high"],"_cs_tags":["idor","web-application-vulnerability","vulnerability"],"_cs_type":"advisory","_cs_vendors":["LingGuo"],"content_html":"\u003cp\u003eLingGuo-Drama, an application for managing short-drama projects, contains an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-111722. The vulnerability exists in the projects.Get function, which fails to validate project ownership during access requests. By manipulating numeric identifiers within the API, a self-registered user can bypass authorization controls. The impact is significant, as an attacker can read, overwrite, reassign, or delete any project hosted on the instance, regardless of whether they own it. This issue affects all versions of the application up to and including commit 8a6924a. Defenders should prioritize auditing web server access logs for anomalous patterns of sequential numeric ID requests to the project management API endpoints.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unprivileged, self-registered user to access and manipulate data belonging to other users. This can lead to total loss of project confidentiality, integrity, and availability within the impacted LingGuo-Drama instance. The vulnerability poses a high risk to any organization hosting this software, as it requires no elevated privileges to execute unauthorized administrative actions on project objects.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of LingGuo-Drama running versions up to commit 8a6924a and evaluate the necessity of exposure to untrusted users.\u003c/li\u003e\n\u003cli\u003eImplement strict authorization logic in the projects.Get function to ensure that the requester's ID matches the project owner's ID.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high-frequency GET, PUT, or DELETE requests to /admin/v1/projects/:id where the :id parameter follows a sequential pattern.\u003c/li\u003e\n\u003cli\u003ePatch or upgrade the LingGuo-Drama instance immediately upon the availability of a vendor-supplied fix that addresses the missing authorization check.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:51:16Z","date_published":"2026-10-16T18:51:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-lingguo-drama-idor/","summary":"LingGuo-Drama through commit 8a6924a is vulnerable to an Insecure Direct Object Reference (IDOR) flaw allowing unauthorized access, modification, and deletion of user projects.","title":"IDOR Vulnerability in LingGuo-Drama","url":"https://feed.craftedsignal.io/briefs/2026-10-lingguo-drama-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - LingGuo","version":"https://jsonfeed.org/version/1.1"}