CVE-2026-54050: 
Java vulnerability analysis and mitigation

CVE-2026-54050 is an Insecure Direct Object Reference (IDOR) vulnerability in the Sakai Learning Management System's REST API that allows any authenticated user to delete the profile image of any other user, including administrators. The flaw exists in the DELETE /api/users/{userId}/profile/image endpoint, which performs no authorization check to verify that the requesting user owns the target profile. Affected Maven packages are org.sakaiproject.profile2:profile2-api and org.sakaiproject.profile2:profile2-impl, covering Sakai versions 23.0–23.4 and 25.0–25.2. The vulnerability was first reported on June 2, 2026, with a fix committed the same day, and the advisory was published to the GitHub Advisory Database on August 24, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Sakai Security Advisory).

The root cause is a missing authorization check (CWE-639: Authorization Bypass Through User-Controlled Key) in ProfileController.removeProfileImage() within the webapi module. The controller verifies only that a valid session exists but never compares the authenticated user's ID against the userId path parameter, allowing an attacker to supply any arbitrary user ID. The call chain then passes this attacker-controlled userId directly to ProfileServiceImpl.removeProfileImage() → dao.removeProfileImage(userUuid) → profileImageUploadedRepository.deleteById(userId), which unconditionally removes the profile_images_t database row. The delete further cascades through the Content Hosting Service (CHS) using a security advisor that bypasses all CHS permission checks. A secondary issue exists in the DELETE /api/users/{userId}/profile/pronunciation endpoint, which lacked any checkSakaiSession() call entirely, making it accessible without authentication. By contrast, the upload endpoint setProfileImage() correctly enforces ownership, creating an asymmetric security posture (GitHub Advisory, Fix Commit).

Any authenticated user — including low-privileged roles such as students or guests — can permanently delete the profile image of any other user on the platform, including administrators and instructors. The attack is trivially scriptable and can be executed in bulk against all users simultaneously, causing widespread profile defacement. In university environments where profile photos are used for identity verification in proctored exams or student directories, this could disrupt identity management workflows and undermine trust in the platform. There is no confidentiality impact, but the integrity impact is rated High due to the ability to permanently destroy user data without authorization (Sakai Security Advisory).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is 0.044% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, exploitation requires only a valid authenticated session and a single HTTP DELETE request with a modified userId path parameter, making it trivially easy to execute manually or via scripting (GitHub Advisory).

1. Obtain authentication: Log in to the target Sakai instance with any valid account (e.g., a student or guest account) and capture the SAKAIID session cookie from the browser or via an authenticated HTTP request.
2. Identify target user IDs: Enumerate user IDs of targets (e.g., admin, or other known usernames/UUIDs) through Sakai's user directory, public profile pages, or API endpoints that expose user information.
3. Send malicious DELETE request: Issue a DELETE /api/users/{targetUserId}/profile/image HTTP request to the Sakai server, substituting {targetUserId} with the victim's user ID and including the attacker's valid SAKAIID cookie:

   DELETE /api/users/admin/profile/image HTTP/1.1
   Host: <sakai-host>:9107
   Cookie: SAKAIID=<attacker-session-token>

4. Confirm deletion: The server responds with HTTP 200 OK. The victim's profile image row is removed from the profile_images_t database table and the associated file is deleted from Content Hosting Service storage.
5. Repeat at scale: Script the DELETE request in a loop over a list of user IDs to bulk-delete profile images across the entire platform (Sakai Security Advisory).

• Network: Unusual volume of DELETE /api/users/*/profile/image requests from a single IP or session, especially targeting user IDs other than the authenticated user's own ID; DELETE requests to /api/users/*/profile/pronunciation from unauthenticated sessions (no valid SAKAIID cookie).
• Logs: Web server or application access logs showing DELETE /api/users/<admin-or-other-userId>/profile/image requests returning HTTP 200 from a session belonging to a different, lower-privileged user; repeated deletion attempts across multiple user IDs in a short time window.
• Database: Missing rows in the profile_images_t table for users who previously had custom profile images (SELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t returning empty results for known users); audit log entries showing deletions not initiated by the profile owner or an administrator.
• File System: Absence of previously existing profile image files under /private/profileImages/<userId>/ in the Content Hosting Service storage directory.

Upgrade to Sakai version 23.5, 25.3, or 26.0, which include the fix committed on June 2, 2026 (commit a092dbf). The fix adds a checkCanModifyProfile() authorization method in ProfileServiceImpl that verifies the current user is either a superuser or the profile owner before allowing deletion, and adds checkSakaiSession() to the pronunciation recording delete endpoint. No configuration-based workaround is available; upgrading to a patched release is the only remediation. Organizations unable to upgrade immediately should consider restricting access to the /api/users/*/profile/image and /api/users/*/profile/pronunciation endpoints at the network or WAF level as a temporary measure (Sakai Security Advisory, Sakai 23.5 Release, Fix Commit).