CVE-2018-15833 In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote f...
MediumCVSS 4.3
EPSS 0.88%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vanillaforums vanilla forums | < 2.6.1 | 2.6.1 |
References
- hackerone.com third-party-advisory
- open.vanillaforums.com vendor-advisory
- twitter.com third-party-advisory
- twitter.com third-party-advisory