CVE-2026-100514

Summary

An unauthenticated IDOR vulnerability allows attackers to access REST API logs without authentication, potentially exposing sensitive operational data. This affects versions 1.7.2 and earlier.

Exploitability

Exploitation is straightforward with no prerequisites, requiring only access to the vulnerable REST API endpoint to enumerate and access logs from other users or systems.

Blast radius

The impact could be significant as attackers may gain access to sensitive operational logs, configuration details, and potentially system credentials or session information from other users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to REST API Log version 1.7.3 or later to remediate the IDOR vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.