MingSoft MCMS CVE-2026-19356

The /mdiy/form/data/list endpoint in the ms-mdiy component must be network-reachable. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication, no user interaction, no special configuration, and no attack prerequisites beyond HTTP access to the endpoint. Exploitation impact is strictly limited to partial confidentiality disclosure (VC:L) - no code execution, no data modification, and no availability impact are indicated by available data. Deployments that expose MCMS on a public network or Internet-facing host carry the highest risk; instances placed behind an authenticated reverse proxy, VPN, or firewall restricting external access have substantially reduced exposure.

The CVSS 4.0 score of 5.5 (Medium) accurately reflects the bounded scope of this vulnerability: the confidentiality impact is partial (VC:L) and there is no integrity or availability component. That said, the combination of unauthenticated network access, zero complexity, and a publicly available exploit means that even a mid-sized municipal IT team in legnica running an internet-facing MCMS instance should treat patching or endpoint restriction as a near-term operational priority rather than deferring it. The E:P threat metric confirms exploit code is circulating, which meaningfully elevates practical exploitation likelihood beyond what the base score implies. No EPSS data was included in the source intelligence, and CISA KEV status is absent, indicating no confirmed mass exploitation campaigns at time of analysis - the risk profile is best characterized as moderate with elevated urgency due to public exploit availability and vendor non-response.

An unauthenticated attacker sends a crafted HTTP GET or POST request directly to the /mdiy/form/data/list endpoint of a publicly exposed MCMS instance. The application responds with form submission data without enforcing any authorization check, allowing the attacker to enumerate records. A public exploit is available per the E:P threat metric, meaning this requires minimal technical skill to execute.