LingGuo-Drama: Insecure direct object reference in admin projects API

Summary

LingGuo-Drama, a platform for managing short-drama projects, does not check the owner of a project when it is accessed via /admin/v1/projects/:id. Any registered user, including self-registered accounts, can iterate numeric IDs to read, overwrite, reassign or delete other users' projects. Exploitation requires only a valid user account and no user interaction, and public technical details exist.

Affected

• LingGuoAI LingGuo-Drama through commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed
• No release version numbers are published.

Fixed in

Unknown. No confirmed fixed version or vendor advisory was found.

Workaround

• No vendor workaround is known.
• Restrict access to /admin/ routes at network or reverse-proxy level.
• Disable or restrict self-registration.
• Review logs for sequential requests to /admin/v1/projects/:id.

Exploitation

• Public technical write-up available; no public exploit code included in this entry.
• No evidence of known exploitation in the wild (CISA SSVC: exploitation PoC, automatable no).
• Attacker needs a registered account (PR:L).

Our recommendation

• Ask whether LingGuo-Drama is deployed in your environment and whether it is reachable from the internet.
• If it is, restrict the admin API and self-registration now.
• Monitor for unusual sequential access to project IDs.
• Review CVE-2026-111723 in the same product, which is rated higher, together with this CVE.
• Do not deploy an unverified fix until the vendor confirms a fixed commit.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (VulnCheck advisory) www.vulncheck.com
• Public write-up (HackMD) hackmd.io
• projects_controller.go at commit 8a6924a github.com
• projects_utils.go at commit 8a6924a github.com
• routes/admin.go at commit 8a6924a github.com
• Vendor GitHub issue #10 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:51.