Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
6,460 results · Feed
-
High 8.8
Information leak in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging socia…
-
High 8.8
Information leak in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive informa…
-
High 8.8
Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data…
-
Critical 9.1
Authorization: Negotiate sent to foreign origin
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…
-
High 8.1
TFTP direction confusion
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that fo…
-
High 8.2
follow-redirects array-form headers bypass cross-origin credential stripping
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-d…
-
Medium 5.3
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce…
-
Medium 5.6
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContain…
-
Medium 4.4
SolarWinds Patch Manager Sensitive Information Exposure Vulnerability
SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.
-
Medium 5.3
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned…
-
Medium 6.0
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage befo…
-
Medium 4.3
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boolean indicating whether a slug is in use across all document types and visibility …
-
Medium 6.0
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrad…
-
Medium 6.5
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An atta…
-
Medium 6.3
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-insta…
-
Medium 4.3
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead …
-
Medium 5.3
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, s…
-
Medium 5.5
A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to …
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be ab…
-
Medium 5.5
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate …
-
Medium 5.5
The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macO…
-
Medium 6.5
Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox co…
-
Medium 6.5
Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the san…
-
High 8.2
follow-redirects sensitiveHeaders regex escaping can expose credential headers
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whos…
-
High 8.5
Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. D…
-
Medium 5.3
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched re…
-
Medium 6.9
FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct u…
-
Medium 6.9
FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template_exists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter…
-
Medium 5.3
ai-genius-automations octoally index.ts information disclosure
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiate…
-
High 7.5CVE-2026-85251 Public exploit
Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host c…
-
High 8.2CVE-2026-78164 Public exploit
Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0…
-
Medium 5.9CVE-2026-78163 Public exploit
Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component. This issue affects Apache Camel:…
-
High 7.5
Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users …
-
Medium 5.3
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A…
-
High 7.1
MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the confi…
-
High 7.5
Apache Kylin: Potential unauthenticated job metadata replacement
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are …
-
Medium 5.3
MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As …
-
Medium 5.3
Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulat…
-
Medium 5.3
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifie…
-
Critical 9.3
Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in G…