CVE-2020-27358

4.3 mediumEPSS 2.0%

Medium (4.3) in vanderbilt redcap. EPSS 2.0% chance of exploitation in the next 30 days.

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-276
Published: 2020-11-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vanderbilt:redcap

References

https://github.com/seb1055/cve-2020-27358-27359
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
https://www.ruse.tech/blog/38
https://github.com/seb1055/cve-2020-27358-27359
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/

Check your stack JSON