VULNERABILITY INTELLIGENCE

CVE-2026-30689

CVSS score4.3 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2026-03-27
Last modified2026-07-02
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

Weakness classification

  • cve@mitre.org: CWE-863
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Primary references