---
id: CVE-2026-1213
aliases:
  - GHSA-r2jv-fwfr-4j8c
  - PYSEC-2026-1193
title: >-
  askbot inexhaustive permissions check allows any user to modify a different
  user's profile picture
summary: >-
  askbot inexhaustive permissions check allows any user to modify a different
  user's profile picture
severity: medium
vendor: askbot
product: askbot
ecosystem: pip
affected:
  - askbot < 0.12.3
patched:
  - askbot 0.12.3
published: '2026-01-27'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-r2jv-fwfr-4j8c'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-1213'
  - url: >-
      https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d
  - url: 'https://askbot.com'
  - url: 'https://fluidattacks.com/advisories/ghost'
  - url: 'https://github.com/askbot/askbot-devel'
tags:
  - osv
  - pip
epss: 0.00361
epssPercentile: 0.27113
ingestedAt: '2026-07-08T18:25:52.617Z'
---

## Overview

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users. This issue affects askbot: 0.12.2.

## Affected packages

- `askbot < 0.12.3`

## Remediation

Upgrade to a patched release:

- `askbot 0.12.3`