Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 7.5 High severity
CatFolders Document Gallery & PDF Library: Exposure of Sensitive Information to an Unauthorized Actor
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any
- 7.3 High severity
Linux: Exposure of Sensitive Information to an Unauthorized Actor
In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 ("md: port block device access to file") accidentally causes the caller's thread
- 7.5 High severity
Product Feed PRO for WooCommerce by AdTribes: Exposure of Sensitive Information to an Unauthorized Actor
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) a
- 7.5 High severity
GitPython: Exposure of Sensitive Information to an Unauthorized Actor
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment va
- 9.1 Critical severity
Portal Generator addon to Priority ERP…: Exposure of Sensitive Information to an Unauthorized Actor
: Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator
- 8.6 High severity
Portal Generator addon to Priority ERP…: Exposure of Sensitive Information to an Unauthorized Actor
: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).. This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions).: All versions
- 7.5 High severity
budibase: Exposure of Sensitive Information to an Unauthorized Actor
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could que
- 8.6 High severity
siyuan: Exposure of Sensitive Information to an Unauthorized Actor
SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a pas
- 7.5 High severity
WP Photo Album Plus: Exposure of Sensitive Information to an Unauthorized Actor
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthent
- 7.5 High severity
Total Upkeep: Exposure of Sensitive Information to an Unauthorized Actor
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site res
- 7.5 High severity
Import WP: Exposure of Sensitive Information to an Unauthorized Actor
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data su
- 7.5 High severity
kestra: Exposure of Sensitive Information to an Unauthorized Actor
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can exp
- 8.2 High severity
ishankportfolio: Exposure of Sensitive Information to an Unauthorized Actor
ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed dat
- 7.6 High severity
typebot.io: Exposure of Sensitive Information to an Unauthorized Actor
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks
- 7.5 High severity
Microsoft Teams for iOS: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.
- 7.9 High severity
Intel(R) PROSet/Wireless WiFi Software for…: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined wit
- 7.6 High severity
typebot.io: Exposure of Sensitive Information to an Unauthorized Actor
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path
- 7.5 High severity
OpenSign: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns th
- 7.5 High severity
mastodon: Exposure of Sensitive Information to an Unauthorized Actor
Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying i
- 7.5 High severity
Apache Tapestry: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.
- 7.5 High severity
Contact Form to Any API: Exposure of Sensitive Information to an Unauthorized Actor
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by oth
- 7.5 High severity
Login & Register Forms: Exposure of Sensitive Information to an Unauthorized Actor
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered user
- 7.5 High severity
File Manager: Exposure of Sensitive Information to an Unauthorized Actor
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files
- 7.5 High severity
File Manager: Exposure of Sensitive Information to an Unauthorized Actor
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name
- 7.5 High severity
Salon Booking System: Exposure of Sensitive Information to an Unauthorized Actor
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, includ
- 7.5 High severity
HT Contact Form: Exposure of Sensitive Information to an Unauthorized Actor
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
- 7.5 High severity
WPC Order Tip for WooCommerce: Exposure of Sensitive Information to an Unauthorized Actor
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as
- 7.5 High severity
WP Data Access: Exposure of Sensitive Information to an Unauthorized Actor
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of
- 7.5 High severity
GeoDirectory: Exposure of Sensitive Information to an Unauthorized Actor
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pendin
- 7.5 High severity
WP Directory Kit: Exposure of Sensitive Information to an Unauthorized Actor
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 sett
- 7.5 High severity
Admin Safety Guard — Login Security, Limit…: Exposure of Sensitive Information to an Unauthorized Actor
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered
- 8.6 High severity
element-call: Exposure of Sensitive Information to an Unauthorized Actor
Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Severa
- 9.2 Critical severity
TeamDavid: Exposure of Sensitive Information to an Unauthorized Actor
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint
- 7.5 High severity
Password Protected — Lock Entire Site, Pages…: Exposure of Sensitive Information to an Unauthorized Actor
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the s
- 8.0 High severity
appointment-booking-software: Exposure of Sensitive Information to an Unauthorized Actor
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}` endpoint returns the full tenant record to any authenticated `TENANT_ADMIN` of that tenant, includin
- 7.5 High severity
decidim: Exposure of Sensitive Information to an Unauthorized Actor
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs,
- 9.8 Critical severity
Virtual Storage Integrator for VMware vSphere…: Exposure of Sensitive Information to an Unauthorized Actor
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclos
- 7.5 High severity
Events Manager: Exposure of Sensitive Information to an Unauthorized Actor
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is k
- 7.5 High severity
Gutenberg Essential Blocks: Exposure of Sensitive Information to an Unauthorized Actor
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post t
- 7.5 High severity
Gutenberg Essential Blocks: Exposure of Sensitive Information to an Unauthorized Actor
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime num