CVE-2026-1196
BaseFortify
Publication date: 2026-01-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mineadmin | mineadmin | 1.0 |
| mineadmin | mineadmin | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1196 is an information disclosure vulnerability in MineAdmin versions 1.x and 2.x, specifically in the /system/getFileInfoById endpoint. By manipulating the file ID parameter, an attacker can enumerate file IDs and read sensitive file information such as file hashes without authorization. Using these hashes, the attacker can preview or download files through other endpoints, leading to unauthorized disclosure of sensitive data. The vulnerability can be exploited remotely but requires a high level of complexity and privileges. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive files and data stored in the MineAdmin system. Attackers can remotely access and download confidential information without proper authorization, potentially compromising data confidentiality and security. Since there are no known mitigations or patches and the vendor has not responded, affected users remain at risk until they replace or secure the system. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring and testing the /system/getFileInfoById endpoint for unauthorized access attempts using manipulated ID parameters. Since the vulnerability involves enumeration of file IDs to read file information, you can use HTTP request tools like curl or specialized vulnerability scanners to send requests with varying ID values to see if sensitive file information is disclosed. For example, a command like `curl -v http://<target>/system/getFileInfoById?id=1` and incrementing the ID value can help detect if unauthorized file info is accessible. Additionally, monitoring network traffic for unusual requests to this endpoint or unexpected file hash retrievals can help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
There are no known patches or vendor-provided mitigations for this vulnerability as the vendor did not respond to the disclosure. Immediate mitigation steps include restricting access to the affected endpoint /system/getFileInfoById by implementing network-level controls such as firewall rules or access control lists to limit who can reach this endpoint. Consider disabling or restricting the use of the affected API if possible. Monitoring for exploitation attempts and preparing to replace the affected MineAdmin product with an alternative solution are also recommended due to the lack of fixes. [2]