CVE-2026-1433CWE-522

uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure

Medium · published July 6, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

uniFLOW Universal Login Manager (ULM) Standalone

contains an information disclosure vulnerability that may allow an

authenticated administrator to access sensitive configuration information

through the ULM Remote User Interface (RUI). Exploitation requires

administrative privileges and may disclose configuration data associated with

SMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or

uniFLOW Online are not affected.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-07-06T08:12Z
EPSS history
Timeline
  • 06 JUL 08:12Z
    uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure
    cvelistv5