CVE-2026-30689

CVSS 4.3 MEDIUMEPSS 0.3%CWE-284 CWE-863

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

27 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Produtos afetados

anjoy8 · Blog.Core

Referências

https://gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40 https://github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/UserController.cs#L139-L140