Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 7.5 High severity
webMethods Integration Server: Exposure of Sensitive Information to an Unauthorized Actor
IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.
- 7.5 High severity
kit: Exposure of Sensitive Information to an Unauthorized Actor
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run
- 9.9 Critical severity
Jet Admin Cloud Platform: Exposure of Sensitive Information to an Unauthorized Actor
A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.
- 7.1 High severity
Eclipse BaSyx Go Components: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel
- 7.1 High severity
Eclipse BaSyx Go Components: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's `FILTERLIST` fragment filters to single Submodel reads. `GET /submodels` removes the fi
- 7.5 High severity
siyuan: Exposure of Sensitive Information to an Unauthorized Actor
SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod
- 7.7 High severity
siyuan: Exposure of Sensitive Information to an Unauthorized Actor
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/cre
- 8.2 High severity
jDownloads extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to b
- 8.8 High severity
AcyMailing extension for Joomla and WordPress: Exposure of Sensitive Information to an Unauthorized Actor
Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker
- 9.2 Critical severity
misp-modules: Exposure of Sensitive Information to an Unauthorized Actor
The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model seri
- 7.1 High severity
Grafana Enterprise: Exposure of Sensitive Information to an Unauthorized Actor
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned das
- 7.1 High severity
Grafana OSS: Exposure of Sensitive Information to an Unauthorized Actor
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This af
- 8.4 High severity
kaneo: Exposure of Sensitive Information to an Unauthorized Actor
Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including t
- 7.5 High severity
bird-lg-go: Improper Neutralization of Argument Delimiters in a Command
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been pat
- 7.5 High severity
Mail Debug for WooCommerce: Exposure of Sensitive Information to an Unauthorized Actor
The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone
- 7.4 High severity
scriban: Exposure of Sensitive Information to an Unauthorized Actor
Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or R
- 7.1 High severity
grav: Exposure of Sensitive Information to an Unauthorized Actor
Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read serv
- 7.7 High severity
freescout: Improper Neutralization of Special Elements used in an SQL Command
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes.
- 7.5 High severity
openemr: Exposure of Sensitive Information to an Unauthorized Actor
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::g
- 8.8 High severity
openhuman: Exposure of Sensitive Information to an Unauthorized Actor
OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted
- 8.2 High severity
LiteSpeed Cache: Exposure of Sensitive Information to an Unauthorized Actor
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Sto
- 7.5 High severity
traccar: Exposure of Sensitive Information to an Unauthorized Actor
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who kn
- 8.2 High severity
symfony: Exposure of Sensitive Information to an Unauthorized Actor
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/ste
- 7.7 High severity
Fabric Composer: Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are me
- 8.8 High severity
Fabric Composer: Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploita
- 7.2 High severity
froxlor: Exposure of Sensitive Information to an Unauthorized Actor
Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super admin
- 7.5 High severity
Eclipse Vert.x: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and
- 8.4 High severity
jack: Exposure of Sensitive Information to an Unauthorized Actor
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non
- 7.1 High severity
ladybird: Exposure of Sensitive Information to an Unauthorized Actor
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with th
- 7.5 High severity
pdf-reader-mcp: Exposure of Sensitive Information to an Unauthorized Actor
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentica
- 7.5 High severity
Advanced Custom Fields: Extended: Exposure of Sensitive Information to an Unauthorized Actor
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including th
- 9.3 Critical severity
CoPilot: Exposure of Sensitive Information to an Unauthorized Actor
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even
- 8.2 High severity
Forocoches comments editor: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their
- 7.5 High severity
pipelines: Exposure of Sensitive Information to an Unauthorized Actor
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selecte
- 9.4 Critical severity
FearlessCMS: Improper Limitation of a Pathname to a Restricted Directory
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or ade
- 8.1 High severity
Apache Kafka: Exposure of Sensitive Information to an Unauthorized Actor
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration
- 8.1 High severity
Thunderbird: Exposure of Sensitive Information to an Unauthorized Actor
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the atta
- 7.5 High severity
Thunderbird: Exposure of Sensitive Information to an Unauthorized Actor
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, th
- 7.5 High severity
grav: Exposure of Sensitive Information to an Unauthorized Actor
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remot
- 8.1 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.