CVE-2026-30689

4.3 mediumEPSS 0.3%

Medium (4.3) in anjoy8 blog.admin. EPSS 0.3% chance of exploitation in the next 30 days.

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWEs: CWE-863, CWE-284
Published: 2026-03-27
Modified: 2026-07-02
Record from: the NVD, synced 2026-10-19

Affected

anjoy8:blog.admin

References

https://gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40
https://github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/UserController.cs#L139-L140

Check your stack JSON