CVE-2023-37749

MediumCVSS 5.3

Published: 27/10/2025(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

29th percentile - higher than 29% of all known CVEs

Summary

Incorrect access control in the HubSpot REST API endpoint v1.29441 allows unauthenticated attackers to view users' data without proper authorization.

Risk Assessment

An unauthenticated attacker could access user data, breaching confidentiality. This may lead to leakage of personal or business data.

Recommendation

Update HubSpot to a version containing the REST API access control fix. Verify that the endpoint enforces authentication and authorization.

Other vulnerabilities in HubSpot

CVE-2026-57736High
An insertion of sensitive information into sent data vulnerability in HubSpot allows retrieval of embedded sensitive data. This issue affects HubSpot from n/a through 11.3.51.

Original NVD description (English source)

Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS