Summary

The get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check.

This is distinct from CVE-2026-30876 (login response discrepancy). That vulnerability only confirms username existence via response timing. This vulnerability returns full PII (email, real name) via an authenticated API endpoint.

Details

Affected code: main/webservices/api/v2.php (Lines 583-614)

case Rest::GET_USER_INFO_FROM_USERNAME:
    $loginname = trim($httpRequest->request->get('loginname'));
    if (empty($loginname)) {
        throw new Exception(get_lang('NoData'));
    }
    $item = api_get_user_info_from_username($loginname);  // NO authorization check
    if (!$item) {
        throw new Exception(get_lang('NoUser'));
    }
    $userInfo = [
        'id' => $item['user_id'],
        'firstname' => $item['firstname'],
        'lastname' => $item['lastname'],
        'email' => $item['email'],       // PII exposed to any user
        'username' => $item['username'],
        'active' => $item['active'],
    ];

No call to api_is_platform_admin(), protectAdminEndpoint(), or any role verification.

Impact

• Any authenticated user can harvest all users' email addresses and real names
• Enables targeted phishing and social engineering
• Critical when chained with Advisory 3: email discovery → sha1(email) → password reset → account takeover
• Iteration over common usernames reveals entire user directory

Verified Attack Chains

Chain 1: Unauthenticated Admin Account Takeover (Advisory 4 → 5 → 3)

Attacker (no credentials, knows username "admin")
  ├─ Adv 4: Brute-force API key (~3,800 attempts for 2h window)
  ├─ Adv 5: get_user_info_from_username → admin email
  ├─ Adv 3: sha1(email) → reset admin password
  └─ RESULT: Admin account takeover

Chain 2: Student Privilege Escalation (Advisory 1)

Student account
  ├─ Adv 1: update_user_from_username (status=1)
  └─ RESULT: Student → Teacher (course creation, grading)