CVE-2026-30689

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Incorrect Authorization pada anjoy8 blog.admin. Skor CVSS 3.1 4.3 (Medium) menurut mitre.org.

Deskripsi (NVD)

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

2 Juli 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization
CWE-284: Improper Access Control

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40 exploit · advisory pihak ketiga
• https://github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/Us...