H3-2026-0035¶
Personal Information Disclosure to Unauthenticated Users
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 5.5 |
Description¶
A web application returned personally identifiable information of users to an unauthenticated client in a publicly accessible response.
Impact¶
An attacker who reads the response obtains unauthorized personal data on other users. The information could be used for extortion, targeted phishing, and possibly account takeover. If affected individuals are in the EU or EEA, this could constitute a personal data breach under the GDPR.