PT-2026-6794 · Deepaudit · Deepaudit

Ez-Lbz · Published 2026-02-06 · Updated 2026-02-28 · CVE-2026-25729

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DeepAudit versions prior to 3.0.5

Description An improper access control issue exists in DeepAudit versions 3.0.4 and earlier. The /api/v1/users/ API endpoint allows any authenticated user to enumerate all users within the system. This allows retrieval of sensitive information such as email addresses, phone numbers, full names, and role information. The vulnerable parameter is not specified.

Recommendations Update DeepAudit to version 3.0.5 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25729

GHSA-VMMM-48W2-Q56Q

Affected Products

Deepaudit

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25729.json · Exploit
• https://github.com/lintsinghua/DeepAudit/security/advisories/GHSA-vmmm-48w2-q56q · Vendor Advisory
• https://github.com/lintsinghua/DeepAudit/commit/b2a3b26579d3fdbab5236ae12ed67ae2313175fd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25729 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25729 · Vendor Advisory
• https://t.me/cveNotify/153615 · Telegram Post
• https://t.me/CVEtracker/43971 · Telegram Post
• https://twitter.com/CVEnew/status/2019876693239034282 · Twitter Post