askbot inexhaustive permissions check allows any user to modify a different user's profile picture
Date: 2026-01
Affected: pip/askbot
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-1213
CWE: CWE-639

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users. This issue affects askbot: 0.12.2.


Mitigations:

Architectural layers (MAESTRO):