What’s Vulnerable › Vulnerabilities

CVE-2026-30689

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-27 · updated 2026-07-02
• Weakness: CWE-863

Description

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

Affected products

• Anjoy8 Blog.Admin: 8.0

References

• https://gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40
• https://github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/UserController.cs#L139-L140

Get alerted when CVE-2026-30689 or the next vulnerability affects your stack