CVE-2026-100514

HighCVSS 7.5

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

19th percentile - higher than 19% of all known CVEs

Summary

The REST API Log plugin in versions up to 1.7.2 contains an Insecure Direct Object References (IDOR) vulnerability exploitable by an unauthenticated attacker. Missing access controls allow access to objects the user should not be authorized to access.

Risk Assessment

An unauthenticated attacker may access API logs or other data, potentially leading to leakage of sensitive information.

Recommendation

Update the REST API Log plugin to a version newer than 1.7.2. Until then, consider restricting access to API endpoints.

Other vulnerabilities in REST API Log

CVE-2026-66443High
Unauthenticated Sensitive Data Exposure vulnerability in REST API Log versions up to 1.7.1.

Original NVD description (English source)

Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS