Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 8.2 High severity
BC-LTS-JAVA: Exposure of Sensitive Information to an Unauthorized Actor
In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the
- 7.5 High severity
Apache HTTP Server: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affec
- 7.5 High severity
Payments for Hubtel: Exposure of Sensitive Information to an Unauthorized Actor
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those cr
- 8.6 High severity
Secure Data Forms: Exposure of Sensitive Information to an Unauthorized Actor
A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a publish
- 7.8 High severity
GeForce: Exposure of Sensitive Information to an Unauthorized Actor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause exposure of kernel stack contents including return addresses and pointers. A successful exploit of this vulnerability might lead to code
- 8.1 High severity
Fireware OS: Exposure of Sensitive Information to an Unauthorized Actor
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files a
- 8.4 High severity
Eclipse ThreadX: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure
- 7.5 High severity
Mediawiki - CentralAuth Extension: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 7.5 High severity
Mediawiki - EventBus Extension: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.
- 9.1 Critical severity
pyjwt: Exposure of Sensitive Information to an Unauthorized Actor
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attac
- 7.6 High severity
AzuraCast: Exposure of Sensitive Information to an Unauthorized Actor
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attack
- 7.5 High severity
vm2: Exposure of Sensitive Information to an Unauthorized Actor
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin
- 7.1 High severity
froxlor: Exposure of Sensitive Information to an Unauthorized Actor
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings q
- 7.7 High severity
kyverno: Exposure of Sensitive Information to an Unauthorized Actor
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A
- 8.1 High severity
server: Exposure of Sensitive Information to an Unauthorized Actor
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI spe
- 8.0 High severity
grav: Exposure of Sensitive Information to an Unauthorized Actor
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that
- 7.5 High severity
capgo.app: Exposure of Sensitive Information to an Unauthorized Actor
capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 stor
- 8.3 High severity
OpenClaw: Exposure of Sensitive Information to an Unauthorized Actor
OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unsc
- 7.5 High severity
OpenClaw: Exposure of Sensitive Information to an Unauthorized Actor
OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were r
- 7.1 High severity
actual: Exposure of Sensitive Information to an Unauthorized Actor
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the
- 7.1 High severity
zammad: Exposure of Sensitive Information to an Unauthorized Actor
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group
- 7.1 High severity
rabbitmq-server: Exposure of Sensitive Information to an Unauthorized Actor
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP us
- 7.5 High severity
openobserve: Exposure of Sensitive Information to an Unauthorized Actor
OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filte
- 7.5 High severity
rsdoctor: Exposure of Sensitive Information to an Unauthorized Actor
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint w
- 8.1 High severity
authentik: Exposure of Sensitive Information to an Unauthorized Actor
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change t
- 8.6 High severity
klever-go: Exposure of Sensitive Information to an Unauthorized Actor
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message i
- 8.2 High severity
Easy Store extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server ret
- 7.7 High severity
formie: Exposure of Sensitive Information to an Unauthorized Actor
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID
- 7.3 High severity
ALE: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or
- 7.5 High severity
ALE: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to cert
- 8.6 High severity
mcp-atlassian: Improper Limitation of a Pathname to a Restricted Directory
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atl
- 9.6 Critical severity
dokploy: Exposure of Sensitive Information to an Unauthorized Actor
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those pro
- 7.1 High severity
twenty: Exposure of Sensitive Information to an Unauthorized Actor
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an
- 8.8 High severity
ntopng: Exposure of Sensitive Information to an Unauthorized Actor
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin
- 7.5 High severity
YS LeadGen – Popup Builder, Popup Maker & Form…: Exposure of Sensitive Information to an Unauthorized Actor
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthent
- 7.5 High severity
MgoSync: Exposure of Sensitive Information to an Unauthorized Actor
The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configure
- 7.5 High severity
devalue: Exposure of Sensitive Information to an Unauthorized Actor
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rath
- 9.8 Critical severity
HCL BigFix Service Management: Improper Neutralization of Special Elements used in an SQL Command
HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request va
- 7.6 High severity
omni: Exposure of Sensitive Information to an Unauthorized Actor
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in i
- 9.8 Critical severity
Launcher: Improper Limitation of a Pathname to a Restricted Directory
GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.cha