CVE-2026-30689CWE-863

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure

Medium · published March 27, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
24.4
In the wild
Unconfirmed
What it is

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-27T00:00Z
EPSS history
Timeline
  • 27 MAR 00:00Z
    In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure
    cvelistv5