Answer in brief
CVE-2026-54050 records a Medium severity (CVSS 6.5) vulnerability in Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image. The current sources do not mark it as known exploited. The current feed maps sakaiproject/sakai (generic), org.sakaiproject.profile2:profile2-api (maven), org.sakaiproject.profile2:profile2-api (maven), org.sakaiproject.profile2:profile2-api (maven) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps sakaiproject/sakai (generic), org.sakaiproject.profile2:profile2-api (maven), org.sakaiproject.profile2:profile2-api (maven), org.sakaiproject.profile2:profile2-api (maven) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| sakaiproject/sakaigeneric | >= 23.0, < 23.5 || >= 25.0, <= 25.2 | Not reported |
| org.sakaiproject.profile2:profile2-apimaven | >=23.0,<23.5 | 23.5 |
| org.sakaiproject.profile2:profile2-apimaven | >=25.0,<=25.2 | Not reported |
| org.sakaiproject.profile2:profile2-apimaven | >=23.0 <23.5 | 23.5 |
| org.sakaiproject.profile2:profile2-apimaven | >=25.0 | Not reported |
| org.sakaiproject.profile2:profile2-implmaven | >=23.0,<23.5 | 23.5 |
| org.sakaiproject.profile2:profile2-implmaven | >=25.0,<=25.2 | Not reported |
| org.sakaiproject.profile2:profile2-implmaven | >=23.0 <23.5 | 23.5 |
| org.sakaiproject.profile2:profile2-implmaven | >=25.0 | Not reported |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.
Quoted source text, attributed separately from HOL analysis.