CVE-2026-51367

Received Received - Intake

Information Disclosure in Vedo Suite

Publication date: 2026-08-19

Last updated on: 2026-08-24

Assigner: MITRE

Description

An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-24

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-51367

EUVD

EUVD-2026-62482

Affected Vendors & Products

Vendor	Product	Version / Range
bottinelli_informatica	vedo_suite	1.2.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-51367 is an Insecure Direct Object Reference (IDOR) vulnerability in Bottinelli Informatica Vedo Suite v1.2.5. It allows authenticated low-privileged users to access unauthorized data by manipulating parameters in API requests, specifically the utente_chat parameter in the /api_vedo/chat endpoint. The flaw stems from missing server-side validation, enabling attackers to retrieve sensitive information belonging to other users.

Detection Guidance

To detect CVE-2026-51367, monitor API requests to the affected endpoints (/api_vedo/dati-ftp and /api_vedo/chat) for unusual parameter manipulation. Check for requests where utente_ftp or utente_chat parameters are modified to reference other users' identifiers. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP POST/GET requests for these patterns.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data, including private FTP information and chat communications of other users. Attackers with a low-privilege account can exploit it to bypass authorization checks and retrieve confidential information, resulting in high confidentiality impact.

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR and HIPAA due to unauthorized data exposure. GDPR mandates strict data protection and user consent, while HIPAA requires safeguards for protected health information. The breach of confidentiality could lead to legal penalties and reputational damage.

Mitigation Strategies

Immediately apply vendor patches for Vedo Suite v1.2.5. Implement server-side authorization checks to validate user ownership of requested data. Deploy a Web Application Firewall (WAF) to block malicious parameter manipulation. Restrict access to the vulnerable endpoints until patches are applied. Review user accounts to ensure no unauthorized access has occurred.

Hi! I’m here to help you understand CVE-2026-51367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70