Cisco Slido REST API IDOR leaks user social profile data
CVE-2026-20219 Published on May 6, 2026
A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social profile data of other users or affect quiz and poll results. Cisco has addressed this vulnerability in Cisco Slido and no customer action is needed. This vulnerability existed because of the presence of an insecure direct object reference. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by sending a crafted request to the vulnerable API endpoint. A successful exploit could have allowed the attacker to view the social profiles of other users or affect quiz and poll results.
Vulnerability Analysis
CVE-2026-20219 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an Insecure Direct Object Reference / IDOR Vulnerability?
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVE-2026-20219 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.
Products Associated with CVE-2026-20219
Want to know whenever a new CVE is published for Cisco Webex Meetings? stack.watch will email you.
Affected Versions
Cisco Webex Meetings:- Version 39.10 is affected.
- Version 39.11 is affected.
- Version 39.6 is affected.
- Version 39.7 is affected.
- Version 39.7.4 is affected.
- Version 39.7.7 is affected.
- Version 39.8 is affected.
- Version 39.8.2 is affected.
- Version 39.8.3 is affected.
- Version 39.8.4 is affected.
- Version 39.9 is affected.
- Version 39.9.1 is affected.
- Version 40.1 is affected.
- Version 40.2 is affected.
- Version 40.4 is affected.
- Version 40.4.10 is affected.
- Version 40.6 is affected.
- Version 40.6.2 is affected.
- Version 42.10 is affected.
- Version 42.11 is affected.
- Version 42.6 is affected.
- Version 42.9 is affected.
- Version 42.12 is affected.
- Version 42.7 is affected.
- Version 43.1 is affected.
- Version 43.4 is affected.
- Version 43.4.2 is affected.
- Version 43.5.0 is affected.
- Version 43.4.1 is affected.
- Version N/A is affected.