Is CVE-2026-3111 actively exploited?

No active exploitation of CVE-2026-3111 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-3111 be exploited remotely?

Yes. CVE-2026-3111 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-3111?

CVE-2026-3111 has a CVSS score of 6.9 (MEDIUM).

HOME VULNERABILITIESCVE-2026-3111

MEDIUM

CVE-2026-3111

CWE-284Published: March 16, 2026· Updated: Mar 16, 2026

6.9

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.2th

Official Description

Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg' (translated as 80x90 and 40x45). Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the profile photos of all users via a manipulated URL, enabling them to collect user photos en masse. This could lead to these photos being used maliciously to impersonate identities, perform social engineering, link identities across platforms using facial recognition, or even carry out doxxing.

NVD Source

Technical Analysis

CVE-2026-3111 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X