CVE-2026-25729
Improper Access Control in DeepAudit /api/v1/users Endpoint Exposes Sensitive Data
Publication date: 2026-02-06
Last updated on: 2026-04-29
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lintsinghua | deepaudit | to 3.0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive user information to any authenticated user.
- Exposure of email addresses, phone numbers, full names, and role information of all users in the system.
- Potential privacy violations and increased risk of targeted attacks such as phishing or social engineering.
Although the severity is rated low, the exposure of sensitive user data can have significant privacy and security implications.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
CVE-2026-25729 is an improper access control vulnerability in DeepAudit versions 3.0.4 and earlier, specifically in the /api/v1/users/ endpoint.
This vulnerability allows any authenticated user to enumerate all users in the system and retrieve sensitive information such as email addresses, phone numbers, full names, and role information.
The root cause is that the endpoint only verifies that a user is logged in but does not enforce authorization checks like requiring administrative privileges.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the /api/v1/users/ endpoint with any authenticated user account and checking if sensitive user information such as email addresses, phone numbers, full names, and role information is returned.'}, {'type': 'paragraph', 'content': 'A simple detection method is to use a command-line tool like curl to send an authenticated GET request to the endpoint and observe the response.'}, {'type': 'list_item', 'content': 'curl -H "Authorization: Bearer <token>" https://<target-system>/api/v1/users/'}, {'type': 'paragraph', 'content': 'If the response contains a list of users with sensitive details, the system is vulnerable.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade DeepAudit to version 3.0.5 or later, where the vulnerability is patched.
The patch restricts access to the /api/v1/users/ endpoint to only active superusers by changing the dependency from get_current_user to get_current_active_superuser.
If upgrading is not immediately possible, restrict access to the vulnerable endpoint by network controls or API gateway rules to allow only trusted administrative users.