Medium severity4.3NVD Advisory· Published Mar 27, 2026· Updated Jul 2, 2026

CVE-2026-30689

Description

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. NOTE: Blog.Admin is related front-end code that does not offer an API service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Anjoy8/Blog.admin
cpe:2.3:a:anjoy8:blog.admin:8.0:*:*:*:*:*:*:*
Anjoy8/Blog.Corellm-create

Patches

Vulnerability mechanics

References

gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40nvdExploitThird Party Advisory
github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/UserController.csnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000