---
id: CVE-2026-116018
title: ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
summary: >-
  ONEARMY community-platform before 2.165.2 contains an insecure direct object
  reference vulnerability that allows authenticated users to mark other users'
  notifications as read via POST /api/notifications/:id/read. Attackers can
  iterate s…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: ONEARMY
product: community-platform
affected:
  - community-platform < 2.165.2
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T11:40:34.948Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116018'
references:
  - url: 'https://github.com/ONEARMY/community-platform/issues/5022'
  - url: 'https://github.com/ONEARMY/community-platform/pull/5011'
  - url: >-
      https://github.com/ONEARMY/community-platform/commit/571732c26caf1a0a46e5335d275cef2e19dfab08
  - url: 'https://github.com/ONEARMY/community-platform/releases/tag/v2.165.2'
    label: community-platform v2.165.2 Release Notes
  - url: >-
      https://github.com/ONEARMY/community-platform/blob/v2.163.2/src/routes/api.notifications.$id.read.ts#L6-L22
  - url: >-
      https://hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor
  - url: >-
      https://www.vulncheck.com/advisories/onearmy-community-platform-before-2.165.2-idor-via-notification-read-endpoint
    label: >-
      VulnCheck Advisory: ONEARMY community-platform before 2.165.2 IDOR via
      notification read endpoint
tags:
  - cve.org
ingestedAt: '2026-10-24T11:57:47.027Z'
---

## Overview

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

## Affected

- `community-platform < 2.165.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.