Wiki CVE-2026-32736

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates low-to-moderate risk with a score of 4.3. The attack vector is network-based, attack complexity is low, requires only low-privilege authentication (PR:L), involves no user interaction, and impacts only confidentiality (C:L) within the system's scope. However, the real-world risk is elevated by the nature of exposed data: mod authors' PII (names and email addresses) are exposed to an unlimited number of authenticated users who can enumerate mod pages. While no active exploitation or POC is explicitly documented in the provided intelligence, the triviality of the attack (simple authenticated HTTP requests to predictable URLs) makes it highly automatable. From an SSVC perspective, this represents a situation where exploitation is straightforward and the technical impact (exposure of PII) is concrete. The availability of a security patch (version 1.0.0) further indicates vendor awareness and resolution. Organizations hosting user-generated content or managing author registries should prioritize patching, particularly given potential GDPR/privacy law implications depending on user jurisdiction.

An attacker creates a free account on the Hytale Modding Wiki and begins systematically visiting mod pages (e.g., /mod/slug-name-1, /mod/slug-name-2, etc.) or iterating through known mod identifiers. Due to the IDOR flaw, each page returns the mod author's full name and email address without authorization checks. The attacker harvests this PII for all public mods, enabling phishing attacks, spam campaigns, or identity-based social engineering against mod creators. The attack requires only network access and a valid account, no special tools, and can be fully automated to compromise the privacy of hundreds of mod authors.