Exposure of Private Personal Information to an Unauthorized Actor
CWE-359
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
We track 56 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.6.
How this weakness is prevented
- Requirements: Identify and consult all relevant regulations for personal privacy. An organization may be required to comply with certain federal and state regulations, depending on its location, the type of business it conducts, and the nature of any private data it handles. Regulations may include Safe Harbor Privacy Framework, Gramm-Leach Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and others.
Latest Exposure of Private Personal Information to an Unauthorized Actor vulnerabilities
- 9.8 Critical severity
hrms: Exposure of Private Personal Information to an Unauthorized Actor
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, cl
- 7.9 High severity
Red Hat Enterprise Linux 10: Exposure of Private Personal Information to an Unauthorized Actor
A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type G
- 7.5 High severity
iOS and iPadOS: Exposure of Private Personal Information to an Unauthorized Actor
A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission.
- 7.5 High severity
iOS and iPadOS: Improper Authentication
A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls.
- 7.5 High severity
Firefox: Exposure of Private Personal Information to an Unauthorized Actor
Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- 7.5 High severity
xwiki-platform: Exposure of Private Personal Information to an Unauthorized Actor
XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTable
- 7.5 High severity
Remote Desktop Web Client: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.
- 7.5 High severity
9Router: Exposure of Private Personal Information to an Unauthorized Actor
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retri
- 7.1 High severity
Microsoft Edge (Chromium-based): Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
- 7.1 High severity
Microsoft Edge (Chromium-based): Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
- 7.5 High severity
phpUploader: Exposure of Private Personal Information to an Unauthorized Actor
phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbound
- 7.5 High severity
node: Exposure of Private Personal Information to an Unauthorized Actor
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or othe
- 7.1 High severity
mercator: Exposure of Private Personal Information to an Unauthorized Actor
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it
- 7.5 High severity
QuMagie: Missing Authorization
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: Qu
- 7.1 High severity
WifiBurada: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass. This issue affects WifiBurada: through 21052026. NOTE: The vendor
- 7.5 High severity
iOS and iPadOS: Exposure of Private Personal Information to an Unauthorized Actor
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users throug
- 8.1 High severity
Apache CloudStack: Exposure of Private Personal Information to an Unauthorized Actor
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume
- 7.5 High severity
Sparx Pro Cloud Server: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. Unauthenticated user can retrieve database password
- 7.5 High severity
happy-dom: Insertion of Sensitive Information Into Sent Data
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "incl
- 7.5 High severity
Apache Answer: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauth
- 7.1 High severity
Crazy Bubble Tea: Exposure of Private Personal Information to an Unauthorized Actor
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915
- 7.5 High severity
Xm530v200 X6-weq 8m Firmware: Exposure of Private Personal Information to an Unauthorized Actor
An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.
- 8.6 High severity
M-Files Server: Exposure of Private Personal Information to an Unauthorized Actor
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
- 7.5 High severity
SoliClub: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Utarit Informatics Services Inc. SoliClub allows Query System for Information. This issue affects SoliClub: from 5.2.4 before 5.3.7.
- 7.5 High severity
AVideo: Exposure of Private Personal Information to an Unauthorized Actor
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.
- 7.5 High severity
Connext Professional: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.2.0 before 7.3.1.
- 7.7 High severity
angular: Insertion of Sensitive Information Into Sent Data
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients
- 8.1 High severity
Excavation Management Information System: Exposure of Private Personal Information to an Unauthorized Actor
Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information Technologies Inc. Excavation Management Information System allows Footprinting, Functionality Misuse
- 7.5 High severity
iOS and iPadOS: Exposure of Private Personal Information to an Unauthorized Actor
A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.
- 7.5 High severity
iOS and iPadOS: Exposure of Private Personal Information to an Unauthorized Actor
The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Imag
- 7.5 High severity
macOS: Exposure of Private Personal Information to an Unauthorized Actor
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
- 7.5 High severity
iOS and iPadOS: Exposure of Private Personal Information to an Unauthorized Actor
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access protected user data.
- 7.5 High severity
enVision: Exposure of Sensitive Information to an Unauthorized Actor
Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allow
- 7.7 High severity
assistant platform: Exposure of Private Personal Information to an Unauthorized Actor
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users.
- 7.5 High severity
Safari: Exposure of Private Personal Information to an Unauthorized Actor
This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may disclose sensitive user informat
- 8.7 High severity
DynamicPageList3: Exposure of Private Personal Information to an Unauthorized Actor
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuse
- 7.5 High severity
Dynamics 365 FastTrack Implementation: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
- 7.5 High severity
Remote Desktop Manager: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries
- 7.5 High severity
transformeroptimus/superagi: Exposure of Private Personal Information to an Unauthorized Actor
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already
- 7.6 High severity
Pik Online: Exposure of Private Personal Information to an Unauthorized Actor
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking. This issue affects Pik Online: before 3.1.5.