{"id":"CVE-2026-30689","aliases":["EUVD-2026-16604","GHSA-x4mm-wg99-32fj"],"status":"published","title":"A blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access...","description":"In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00288,"percentile":0.21619,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-863"],"published":"2026-03-27T00:00:00Z","modified":"2026-11-11T19:10:00Z","products":[{"vendor":"anjoy8","product":"blog.admin"},{"vendor":"anjoy8","product":"blog.core"}],"references":[{"url":"https://gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/UserController.cs#L139-L140","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30689","tags":["advisory"]},{"url":"https://github.com/anjoy8/Blog.Core"},{"url":"http://blagadmin.com"},{"url":"https://github.com/advisories/GHSA-x4mm-wg99-32fj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30689.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-30689","description":"In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.","status":"published","published":"2026-03-27T00:00:00Z","modified":"2026-07-05T01:29:51.969Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-863","CWE-284"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-16604","description":"In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.","status":"published","published":"2026-03-27T00:00:00Z","modified":"2026-07-05T01:29:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:14.793418Z"}],"ghsa":[{"id":"GHSA-x4mm-wg99-32fj","title":"A blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access...","description":"A blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access control which leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security.","status":"published","published":"2026-03-27T15:30:26Z","modified":"2026-07-02T21:33:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-284","CWE-863"],"updated_at":"2026-11-02T15:09:13.018027Z"}],"nvd":[{"id":"CVE-2026-30689","description":"In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.","status":"published","published":"2026-03-27T15:16:53.62Z","modified":"2026-11-11T19:10:00.36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-863","CWE-284"],"updated_at":"2026-11-11T21:26:14.394Z"}],"osv":[{"id":"CVE-2026-30689","description":"In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.","status":"published","published":"2026-03-27T00:00:00Z","modified":"2026-10-28T02:30:22.039482553Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:00.530889Z"}]}}