Executive Summary

CVE-2026-25729 is an improper access control vulnerability in DeepAudit versions 3.0.4 and earlier, specifically in the /api/v1/users/ endpoint.

This vulnerability allows any authenticated user to enumerate all users in the system and retrieve sensitive information such as email addresses, phone numbers, full names, and role information.

The root cause is that the endpoint only verifies that a user is logged in but does not enforce authorization checks like requiring administrative privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive user information to any authenticated user.

• Exposure of email addresses, phone numbers, full names, and role information of all users in the system.
• Potential privacy violations and increased risk of targeted attacks such as phishing or social engineering.

Although the severity is rated low, the exposure of sensitive user data can have significant privacy and security implications.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the /api/v1/users/ endpoint with any authenticated user account and checking if sensitive user information such as email addresses, phone numbers, full names, and role information is returned.'}, {'type': 'paragraph', 'content': 'A simple detection method is to use a command-line tool like curl to send an authenticated GET request to the endpoint and observe the response.'}, {'type': 'list_item', 'content': 'curl -H "Authorization: Bearer <token>" https://<target-system>/api/v1/users/'}, {'type': 'paragraph', 'content': 'If the response contains a list of users with sensitive details, the system is vulnerable.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade DeepAudit to version 3.0.5 or later, where the vulnerability is patched.

The patch restricts access to the /api/v1/users/ endpoint to only active superusers by changing the dependency from get_current_user to get_current_active_superuser.

If upgrading is not immediately possible, restrict access to the vulnerable endpoint by network controls or API gateway rules to allow only trusted administrative users.

Useful 0 Not Useful 0