CVE-2026-1194
BaseFortify
Publication date: 2026-01-20
Last updated on: 2026-02-05
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mineadmin | mineadmin | 1.0 |
| mineadmin | mineadmin | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1194 is an information disclosure vulnerability in MineAdmin versions 1.x and 2.x, specifically in the Swagger component. Due to improper permission validation in the default deployment configuration, an attacker can remotely access sensitive Swagger API documentation by sending a GET request to the endpoint `/swagger/http.json`. This exposes internal API details and system information without requiring authentication, potentially aiding attackers in gathering information about the system. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive internal API information, which may allow attackers to gather detailed information about the backend system. Such information leakage can facilitate further attacks by revealing system structure, endpoints, and potentially sensitive data. Since the vulnerability is remotely exploitable without authentication and a public exploit exists, it poses a moderate security risk. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the Swagger API documentation endpoint is accessible without authentication. Specifically, sending a GET request to the endpoint `/swagger/http.json` on the MineAdmin server can reveal if sensitive information is exposed. For example, you can use the following command to test this: `curl -v http://<target-ip-or-domain>/swagger/http.json`. If the response contains Swagger API documentation data without requiring authentication, the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include strengthening permission validation controls on the Swagger interface to prevent unauthorized access. Since the vulnerability arises from the default deployment configuration exposing Swagger documentation without authentication, restricting access to the Swagger endpoint (e.g., via authentication, IP whitelisting, or disabling Swagger in production) is recommended. If no patch or fix is available from the vendor, consider replacing the affected product with an alternative or disabling the Swagger interface until a secure configuration is ensured. [1, 2]