CVE-2026-24791

HighCVSS 8.1

Published: 13/08/2026(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Public-only tokens can bypass private-resource restrictions on `/api/v1/user` self routes.

Holders of public-only tokens may access private user data, violating confidentiality and potentially leading to information leakage.

Ensure public-only tokens do not have access to routes returning private data. Review and fix authorization logic for these routes.

Original NVD description (English source)

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes