{"id":86665,"date":"2026-03-12T00:09:16","date_gmt":"2026-03-12T00:09:16","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-51869-insecure-direct-object-reference-vulnerability-in-liner","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-51869-insecure-direct-object-reference-vulnerability-in-liner\/","title":{"rendered":"CVE-2025-51869: Insecure Direct Object Reference Vulnerability in Liner<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-51869 is an Insecure Direct Object Reference (IDOR) vulnerability present in Liner, a popular note-taking and web highlighting app. This vulnerability could allow unauthorized access to sensitive information via specially crafted parameters. It’s an alarming issue as it could lead to potential system compromise or data leakage, impacting the confidentiality and integrity of the system.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-51869
\nSeverity: High (CVSS: 7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Unauthorized access to sensitive information, potential system compromise, data leakage.<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Liner | Up to 2025-06-03<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability exists due to insecure direct object references in the application’s space_id, thread_id, and message_id parameters to the v1\/space\/{space_id}\/thread\/{thread_id}\/message\/{message_id} endpoint. A remote attacker can send a specially crafted request with manipulated parameters to the application, allowing them to access data that they are not authorized to view or interact with.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP request where an attacker manipulates the space_id, thread_id, and message_id parameters.<\/p>\n

GET \/v1\/space\/ABC\/thread\/DEF\/message\/GHI HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"space_id\": \"XYZ\", \"thread_id\": \"123\", \"message_id\": \"456\" }<\/code><\/pre>\n
In this example, the attacker replaces the space_id, thread_id, and message_id parameters with unauthorized values, thus gaining access to sensitive information they should not have access to.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-51869 is an Insecure Direct Object Reference (IDOR) vulnerability present in Liner, a popular note-taking and web highlighting app. This vulnerability could allow unauthorized access to sensitive information via specially crafted parameters. It’s an alarming issue as it could lead to potential system compromise or data leakage, impacting the confidentiality and integrity of […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86665","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t