CVE-2026-1213

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.

Score

CVSS 4.0 5.3 Medium

Status

Analyzed - help@fluidattacks.com

Published

2026-01-27

Last modified

2026-01-27

Weaknesses

CWE-639

Affected products

• Askbot (Askbot)

References

• https://askbot.com/
• https://fluidattacks.com/advisories/ghost
• https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d