CVE-2026-53675: BuddyPress Friends API Authorization Bypass

Technical summary

CVE-2026-53675 is an insecure direct object reference (IDOR) vulnerability affecting BuddyPress 14.4.0's friends REST API endpoint. The vulnerability resides in the get_items_permissions_check method, which performs insufficient authorization validation. While the method verifies that the requester holds an authenticated session (PR:L), it fails to enforce ownership checks or role-based access controls on the requested user_id parameter. This permits authenticated attackers to bypass authorization and directly reference arbitrary user objects, retrieving their friend list data. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Business impact

This vulnerability creates privacy and reputational risks for BuddyPress site operators and their user communities. Friend lists often contain sensitive social relationship data that users expect to remain private. Unauthorized enumeration of these lists could facilitate social engineering, targeted harassment, stalking, or competitive intelligence gathering. For platforms operating under data protection regulations such as GDPR or CCPA, unauthorized disclosure of user relationship metadata may trigger compliance obligations and potential liability. The attack requires only a low-privilege authenticated session, meaning any registered user—including free-tier or guest accounts—can execute the attack at scale.

Affected systems

BuddyPress version 14.4.0 is confirmed affected. Users running earlier or later versions should verify their specific release against the vendor advisory to determine applicability. BuddyPress installations with the friends REST API endpoint enabled and user authentication configured are at risk.

Exploitability

The vulnerability is relatively straightforward to exploit. An attacker needs only a valid user account on the target BuddyPress instance. From there, they can directly query the friends endpoint with manipulated user_id parameters to enumerate friend lists across the platform. No user interaction is required, no special network positioning is needed, and exploitation can be automated and scaled. The attack leaves minimal forensic traces unless detailed API access logging is enabled. The CVSS:3.1 score of 4.3 (MEDIUM) reflects the low attack complexity and low privilege requirement, though the impact is limited to confidentiality of social relationship data rather than system integrity or availability.

Remediation

Site administrators should upgrade BuddyPress to a patched version that implements proper authorization checks in the friends REST API endpoint. Verify the specific patched version number in the official BuddyPress security advisory. In the interim, consider disabling public access to the friends REST API if not essential, restricting the endpoint via web application firewall rules, or implementing additional authorization middleware. Review access logs to identify whether unauthorized enumeration has already occurred.

Patch guidance

Consult the official BuddyPress security advisory for the specific patched version addressing CVE-2026-53675. Apply the patch during a maintenance window after testing in a staging environment to ensure compatibility with any custom code or plugins. Verify that the patched version includes authorization checks in the get_items_permissions_check method or its replacement. After patching, confirm that the friends endpoint now properly validates user ownership before returning friend list data.

Detection guidance

Monitor REST API access logs for repeated queries to the /friends endpoint with varying user_id parameters from a single authenticated session or IP address. Establish baselines for normal friend list query patterns per user role. Alert on suspicious patterns such as a single account querying hundreds of distinct user_id values in a short timeframe, or queries originating from automated tools. Enable detailed API audit logging if not already in place. Review access logs from the publication date (2026-06-10) backward to identify potential past exploitation.

Why prioritize this

While the CVSS score is MEDIUM (4.3), this vulnerability warrants prompt attention because: (1) exploitation requires minimal skill and is easily automated, (2) any authenticated account can exploit it regardless of privilege level, (3) the attack is difficult to detect without detailed logging, (4) the data exposed—social relationships—is sensitive and potentially used downstream for further attacks, and (5) regulatory and reputational damage from privacy breaches can be substantial. Organizations should prioritize patching within 2–4 weeks depending on their user base size and sensitivity of exposed data.

Risk score, explained

The CVSS:3.1 score of 4.3 reflects a network-accessible endpoint (AV:N) that is trivial to attack (AC:L) and requires only valid credentials (PR:L) with no user interaction (UI:N). The scope is unchanged (S:U), and the impact is confidentiality loss only (C:L/I:N/A:N). The score appropriately captures a moderate but real privacy risk in a constrained threat model. However, the practical risk may be higher in contexts where friend lists inform downstream targeting or where regulatory exposure is substantial.

Frequently asked questions