CAMP-2026-0001
Failed-event report readable without capability check
Componentlogstore_xapi
SeverityMEDIUM
Affected versions<5.0.3
Fixed in5.0.3
Published2026-07-21T20:29:49Z
Fix released2026-07-20
Details
report.php gated access inside a switch whose default branch performed no capability check, so any authenticated user could read the failed-event log via report.php?id=2&run=1, bypassing the logstore/xapi:viewerrorlog capability. The exposure was limited to operational metadata (event names, error categories, timestamps); no personal data was exposed and no state could be changed. Fixed in 5.0.3, which rejects unknown report IDs. Administrators should upgrade to 5.0.3 or later; no database or configuration changes are required.