VulnerabilityModified

CVE-2026-30689

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure.

MEDIUM 4.3EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.28% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-863, CWE-284
Affected: anjoy8/blog.admin
Source: cve@mitre.org

References

https://gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40Exploit, Third Party Advisory
https://github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/UserController.cs#L139-L140

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.