CVE-2026-102628

Deferred Deferred - Pending Action

Information Disclosure in Cadmos LTI Application

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-102628

EUVD

EUVD-2026-91033

Affected Vendors & Products

Vendor	Product	Version / Range
laravel	laravel	to 2026-09-02 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-489	The product is released with debugging code still enabled or active.
CWE-215	The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Attack-Flow Graph

Executive Summary

This vulnerability involves a Laravel application (Cadmos LTI) with debug mode enabled in a public environment. An attacker could trigger an unhandled exception via a GET request, causing Laravel to expose sensitive server environment details, including all .env configuration variables in plaintext.

Detection Guidance

Check if Laravel debug mode is enabled by inspecting the .env file for APP_DEBUG=true and APP_ENV=local in publicly accessible environments. Send a GET request to the application and look for unhandled exceptions exposing server environment details.

Impact Analysis

An attacker could gain access to sensitive data like database credentials, API keys, or other secrets stored in the .env file. This could lead to further attacks, data breaches, or unauthorized access to the application or underlying systems.

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Disable Laravel debug mode by setting APP_DEBUG=false in the .env file. Ensure the application runs in a non-local environment (APP_ENV=production). Restrict access to debug information and review server configurations to prevent exposure of sensitive data.

Hi! I’m here to help you understand CVE-2026-102628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70