CVE-2026-90989
CVE-2026-90989 · Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.
CVSS 4.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
tainacan
- Versions
- ≥ 0, < 1.4.0: Affected (semver)
Update to 1.4.0