CVE-2026-21626

9.2 criticalEPSS 0.4%

Critical (9.2) in stackideas easydiscuss. EPSS 0.4% chance of exploitation in the next 30 days.

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure

Severity

CVSS 4.0

9.2 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2026-02-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

stackideas:easydiscuss

References

https://stackideas.com/easydiscuss

Check your stack JSON