CVE-2020-27358: Vanderbilt Redcap

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}.

Affected products

• Vanderbilt Redcap: from 8.11.6, before 10.0 (fixed in 10.0)

Published 2020-11-02. Last modified 2026-06-17.