CVE-2026-94410

14th percentile - higher than 14% of all known CVEs

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

Disclosure of the role list may help an attacker reconnaissance the permission structure of the system. The impact on the organization is limited due to the low sensitivity of the data.

Restrict access to the role list to administrators only and verify permissions of low-privileged accounts. Apply the principle of least privilege.