PT-2026-6794 · Deepaudit · Deepaudit

Ez-Lbz · Publicado 2026-02-06 · Atualizado 2026-02-28 · CVE-2026-25729

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DeepAudit versions prior to 3.0.5

Description An improper access control issue exists in DeepAudit versions 3.0.4 and earlier. The /api/v1/users/ API endpoint allows any authenticated user to enumerate all users within the system. This allows retrieval of sensitive information such as email addresses, phone numbers, full names, and role information. The vulnerable parameter is not specified.

Recommendations Update DeepAudit to version 3.0.5 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-25729

GHSA-VMMM-48W2-Q56Q

Produtos afetados

Deepaudit

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25729.json · Exploit
• https://github.com/lintsinghua/DeepAudit/security/advisories/GHSA-vmmm-48w2-q56q · Aviso do Fabricante
• https://github.com/lintsinghua/DeepAudit/commit/b2a3b26579d3fdbab5236ae12ed67ae2313175fd · Correção
• https://t.me/cveNotify/153615 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-25729 · Nota de Segurança
• https://t.me/CVEtracker/43971 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2019876693239034282 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25729 · Aviso do Fabricante