H3-2025-0080¶
Sensitive Information Disclosure to Unauthenticated Users
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 5.3 |
Description¶
This vulnerability occurs when a web application exposes sensitive information to unauthenticated users through publicly accessible pages, endpoints, or files. The root cause is typically a failure to enforce authentication on resources that contain or display sensitive data, combined with insufficient review of what information is rendered to anonymous visitors.
Attackers can discover these exposures through manual browsing, automated crawling, or search engine indexing, and can leverage the disclosed information to escalate access, compromise accounts, or pivot into internal systems.
Impact¶
Exploitation allows an unauthenticated attacker to obtain sensitive information without any credentials or prior access. Depending on the nature of the exposed data, this can lead to account compromise, unauthorized access to internal systems, further exploitation of backend services, or violation of data privacy regulations.