CVE-2026-45248

5.3 Moyenne

Publiée le 15/05/2026 à 00:16 · Modifiée le 15/07/2026 à 00:16 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-306

Références

https://github.com/hashgraph/guardian/pull/6076 Issue TrackingPatch
https://www.vulncheck.com/advisories/hedera-guardian-authentication-bypass-information-disclosure Third Party Advisory

CVE-2026-45248

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs