CVE-2026-104385

Summary

A sensitive data exposure vulnerability in Groundhogg allows unauthenticated attackers to access private user data without requiring any credentials or authentication. This represents a significant privacy and security risk as it exposes potentially sensitive information to anyone who can reach the affected system.

Exploitability

The vulnerability is highly exploitable with no prerequisites as attackers can directly access sensitive data endpoints without authentication, making it easy to leverage for data exfiltration.

Blast radius

The impact could be substantial across all Groundhogg installations running versions 4.8.3 or earlier, potentially exposing personal user information, contact details, and other private data to unauthorized parties.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.8.4 or later to remediate this sensitive data exposure vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.