high · CVSS v3 7.5

CVE-2026-123465

The vulnerability allows an unauthorized control sphere to retrieve embedded sensitive data from myCred installations. It affects all myCred

Overview

The vulnerability allows an unauthorized control sphere to retrieve embedded sensitive data from myCred installations. It affects all myCred versions up to 4.0.2. The flaw can expose confidential system information to attackers.

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.

Impact

Confidentiality: Sensitive system data may be disclosed to unauthorized users. Integrity: Attackers could potentially manipulate data if they gain write access. Availability: Not directly impacted. Defenders: System administrators and security teams must be aware that any myCred installation could leak sensitive information.

Remediation

Apply the latest patch released by myCred (v4.0.3 or later). If patch not available, disable the vulnerable API endpoint or restrict access to the control sphere via firewall rules. Ensure that only trusted users have administrative privileges and monitor logs for anomalous data retrieval attempts.

Risk context

Severity is high with CVSS v3 score 7.5. No EPSS data is available, but the flaw remains relevant for all myCred installations up to 4.0.2. Defenders should treat it as a moderate to high priority vulnerability.

Affected products

  • myCred 4.0.2
  • myCred 4.0.1
  • myCred 4.0.0
  • myCred 3.9.9
  • myCred 3.8.8

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

myCred information-exposure high-severity confidentiality patch-needed

← All CVEs

Related CVEs

high

CVE-2026-124501

Tidelift moto up to 5.2.4 contains a privilege escalation flaw in the AWS Batch Emulation component. The vulnerability allows remote attackers to manipulate the privileged/volumes argument, leading to improper privilege management. It can be exploited without authentication.

View analysis

high

CVE-2026-124509

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

View analysis

high

CVE-2026-124554

A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-124557

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis