CVE-2026-54050: Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/p

Sakai, a web platform for educational collaboration, has a security flaw in versions 23.0 to 23.5 and 25.3 where authenticated users can delete other users' profile images and voice recordings because the system doesn't verify that a user owns the data they're deleting. An attacker could repeatedly remove profile pictures and recordings belonging to administrators or instructors, disrupting workflows that depend on those items.