{"id":"CVE-2026-1213","aliases":["GHSA-r2jv-fwfr-4j8c","PYSEC-2026-1193"],"title":"askbot inexhaustive permissions check allows any user to modify a different user's profile picture","summary":"askbot inexhaustive permissions check allows any user to modify a different user's profile picture","severity":"medium","vendor":"askbot","product":"askbot","ecosystem":"pip","affected":["askbot < 0.12.3"],"patched":["askbot 0.12.3"],"published":"2026-01-27","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-r2jv-fwfr-4j8c","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1213"},{"url":"https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d"},{"url":"https://askbot.com"},{"url":"https://fluidattacks.com/advisories/ghost"},{"url":"https://github.com/askbot/askbot-devel"}],"tags":["osv","pip"],"epss":0.00337,"epssPercentile":0.27287,"ingestedAt":"2026-07-08T18:25:52.617Z","slug":"CVE-2026-1213","body":"## Overview\n\nAll versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users. This issue affects askbot: 0.12.2.\n\n## Affected packages\n\n- `askbot < 0.12.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `askbot 0.12.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}