CVE-2026-45248

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Missing Authentication for Critical Function pada hedera guardian. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

Rincian

Terbit di NVD

14 Mei 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hashgraph/guardian/pull/6076 issue tracking · patch
• https://www.vulncheck.com/advisories/hedera-guardian-authentication-bypass-information-disclosure advisory pihak ketiga