Affected systems do not properly restrict access to internal APIs and paths for authenticated users.
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.
Read at NIST National Vulnerability Database (CVE API 2.0)
- CVSS
- 9.1
- EPSS
- 0.005 (p41)
Why it ranks 30 (Notable)
- CVSS 9.1 critical
- Covered by 3 independent sources
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-44415 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.