What is the CVSS score of CVE-2026-27370?

CVE-2026-27370 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Premio Chaty are affected by CVE-2026-27370?

A HIGH severity vulnerability in Premio Chaty (versions ≤3.5.1) allows attackers to extract embedded sensitive data from application communications.

How to fix or mitigate CVE-2026-27370?

Within 24 hours: Inventory all instances of Premio Chaty in production and development environments; restrict access to the plugin to trusted users only. Within 7 days: Implement network segmentation to limit outbound traffic from systems running Chaty; enable detailed logging of all Chaty transactions for forensic review. Within 30 days: Evaluate alternative chat solutions; establish a vendor communication plan with Premio to obtain patch timeline; conduct a data exposure assessment for any sensitive information previously processed through Chaty.

Premio Chaty CVE-2026-27370

HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-03-05 audit@patchstack.com

Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 7.5

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/a through <= 3.5.1.

AnalysisAI

Premio Chaty versions up to 3.5.1 expose sensitive data through improper handling of embedded information in outbound communications, allowing unauthenticated remote attackers to retrieve confidential data without user interaction. The vulnerability carries a high severity rating (CVSS 7.5) and currently has no available patch.

Technical ContextAI

Affects Premio Chaty chaty. Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/a through <= 3.5.1.