Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 8.2 High severity
Apache Camel: Exposure of Sensitive Information to an Unauthorized Actor
Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.
- 7.5 High severity
Apache Answer: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users a
- 7.1 High severity
MISP: Exposure of Sensitive Information to an Unauthorized Actor
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the config
- 7.5 High severity
Apache Kylin: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are r
- 9.3 Critical severity
SAM: Exposure of Sensitive Information to an Unauthorized Actor
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Go
- 8.5 High severity
arcane: Exposure of Sensitive Information to an Unauthorized Actor
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted t
- 7.5 High severity
Apache Kylin: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
- 7.5 High severity
Apache Kylin: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Ap
- 7.5 High severity
Apache Kylin: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Ky
- 7.5 High severity
Apache Kylin: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
- 7.5 High severity
libiec61850: Integer Underflow (Wrap or Wraparound)
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition
- 7.5 High severity
Apache Kylin: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
- 8.2 High severity
Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authent
- 8.2 High severity
Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will
- 8.1 High severity
WeGIA: Exposure of Sensitive Information to an Unauthorized Actor
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates
- 8.2 High severity
dbt-core: Improper Limitation of a Pathname to a Restricted Directory
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates
- 7.5 High severity
fogproject: Exposure of Sensitive Information to an Unauthorized Actor
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON
- 7.5 High severity
discourse: Exposure of Sensitive Information to an Unauthorized Actor
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when categor
- 9.2 Critical severity
Copart’s online billing service: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details a
- 7.5 High severity
dio: Exposure of Sensitive Information to an Unauthorized Actor
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destinatio
- 8.8 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- 8.1 High severity
TRIRIGA Application Platform: Exposure of Sensitive Information to an Unauthorized Actor
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.
- 7.7 High severity
MarkLogic Server: Exposure of Sensitive Information to an Unauthorized Actor
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this informati
- 7.1 High severity
surrealdb: Exposure of Sensitive Information to an Unauthorized Actor
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move ope
- 7.5 High severity
grav: Exposure of Sensitive Information to an Unauthorized Actor
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin config
- 7.3 High severity
grav-plugin-login: Exposure of Sensitive Information to an Unauthorized Actor
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page render
- 8.8 High severity
nginx-ui: Exposure of Sensitive Information to an Unauthorized Actor
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequire
- 8.7 High severity
Azure API Center: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
- 7.5 High severity
mariadb-connector-nodejs: Exposure of Sensitive Information to an Unauthorized Actor
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's
- 9.6 Critical severity
backstage: Exposure of Sensitive Information to an Unauthorized Actor
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read an
- 8.5 High severity
backstage: Exposure of Sensitive Information to an Unauthorized Actor
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- 9.6 Critical severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- 8.2 High severity
payload: Exposure of Sensitive Information to an Unauthorized Actor
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, pot
- 9.8 Critical severity
plane: Exposure of Sensitive Information to an Unauthorized Actor
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me
- 7.4 High severity
plane: Exposure of Sensitive Information to an Unauthorized Actor
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token
- 8.1 High severity
zitadel: Exposure of Sensitive Information to an Unauthorized Actor
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and