---
id: CVE-2026-111722
title: 'LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API'
summary: >-
  LingGuo-Drama through commit 8a6924a contains an insecure direct object
  reference vulnerability that allows registered users to access other users'
  projects because projects.Get lacks an owner check. Self-registered attackers
  can iterate…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: LingGuoAI
product: LingGuo-Drama
affected:
  - LingGuo-Drama <= 8a6924adf8142678919b4d9a08b9d60c49dcfbed
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:15:35.590797Z'
exploitAvailable: true
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:17:12.430Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111722'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/lingguo-drama-broken-access-control'
  - url: >-
      https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/models/projects/projects_utils.go#L11-L14
  - url: >-
      https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/http/controllers/admin/v1/projects_controller.go#L173-L198
  - url: >-
      https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/routes/admin.go#L26-L31
  - url: >-
      https://www.vulncheck.com/advisories/lingguo-drama-through-commit-8a6924a-idor-via-admin-v1-projects-id-api
    label: >-
      VulnCheck Advisory: LingGuo-Drama through commit 8a6924a IDOR via
      /admin/v1/projects/:id API
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-16T18:43:08.627Z'
---

## Overview

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.

## Affected

- `LingGuo-Drama <= 8a6924adf8142678919b4d9a08b9d60c49dcfbed`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.