CVSS 3.0
4.3 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2014-6276
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- roundup-tracker:roundup
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j556-q367-2gw6 | PyPI | roundup | <1.5.1 | 1.5.1 |
| PYSEC-2016-33 | PyPI | roundup | <1.5.1 | 1.5.1 |