---
id: CVE-2026-69115
title: >-
  OpenIM Server v3.8.3 contains a missing authorization vulnerability that
  allows any authenticated user to access admin-only management API endpoints by
  submitting POST requests with a regular user bearer token to /user/get_users,
  /user/g…
summary: >-
  OpenIM Server v3.8.3 contains a missing authorization vulnerability that
  allows any authenticated user to access admin-only management API endpoints by
  submitting POST requests with a regular user bearer token to /user/get_users,
  /user/g…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
published: '2026-08-11'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69115'
references:
  - url: 'https://github.com/openimsdk/open-im-server'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openimsdk/open-im-server/commit/193870b2f938278b27a2d8347bd7e4db5f8f9dfc
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openimsdk/open-im-server/issues/3778'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openimsdk/open-im-server/pull/3781'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpoints
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openimsdk/open-im-server/issues/3778'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00415
epssPercentile: 0.33046
ingestedAt: '2026-09-24T20:51:40.193Z'
---

## Overview

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.