CVE-2026-71379

Received Received - Intake

Unauthenticated Database Table Export in Software

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: ICS-CERT

Description

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-71379

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated attacker to export arbitrary database tables by sending a crafted POST request to the file export endpoint. It has a maximum severity score of 10.0, indicating critical impact.

Impact Analysis

An attacker could steal sensitive data by exporting database tables without authentication. This may lead to data breaches, unauthorized access to personal or confidential information, and potential system compromise.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access and potential exposure of personal or protected health information. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the file export endpoint by implementing authentication and authorization checks. Disable unauthenticated POST requests to this endpoint and review database permissions to ensure only necessary tables are accessible.

Hi! I’m here to help you understand CVE-2026-71379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70