EUVD-2026-30494
GHSA-5v4v-3g9q-mh5j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.
AnalysisAI
Hedera Guardian through version 3.5.1 allows unauthenticated attackers to retrieve sensitive user information via the GET /api/v1/demo/registered-users endpoint, which lacks proper authentication controls. Attackers can access this endpoint without credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users. The vulnerability affects confidentiality with a CVSS score of 5.3 and has been fixed in the upstream repository via GitHub PR #6076.
Technical ContextAI
The vulnerability exists in the API Gateway's demo service endpoint (api-gateway/src/api/service/demo.ts), specifically in the registeredUsers() method, which queries the Guardian database to return a list of all registered users with their associated metadata. The underlying issue is a missing authentication decorator (@Auth) on the endpoint that should have enforced the DEMO_KEY_CREATE permission. CWE-306 identifies this as a 'Missing Authentication for Critical Function' - the endpoint performs a sensitive operation (user information disclosure) without verifying caller identity. The affected CPE indicates all versions of Hedera Guardian up to and including 3.5.1 are vulnerable. The fix, visible in PR #6076, adds the @Auth decorator to enforce permission checks and injects the authenticated user context into the handler, converting this from an open endpoint to a protected one.
RemediationAI
Upgrade Hedera Guardian to a patched version that includes the fix from PR #6076, which enforces the @Auth(Permissions.DEMO_KEY_CREATE) decorator on the registeredUsers endpoint. The patch adds authentication checks and injects authenticated user context, requiring valid credentials before the endpoint returns user data. Users unable to immediately upgrade should restrict network access to the /api/v1/demo/registered-users endpoint via API gateway firewall rules, load balancer policies, or reverse proxy ACLs to allow only trusted administrative clients. Additionally, review access logs for the endpoint to identify any unauthorized queries of user information and assess exposure scope. Implementing network segmentation to limit API Gateway exposure to internal networks only provides defense-in-depth but does not substitute for the patch. The GitHub PR at https://github.com/hashgraph/guardian/pull/6076 and VulnCheck advisory at https://www.vulncheck.com/advisories/hedera-guardian-authentication-bypass-information-disclosure contain patch details and confirmation.
OS command injection in Guardian language-system lets unauthenticated remote attackers run arbitrary shell commands by i
Remote code execution in Guardian language-system allows unauthenticated attackers to run arbitrary OS commands by injec
Unauthenticated SQL injection in Guardian Language System lets remote attackers manipulate the backend database by injec
Error-based SQL injection in Guardian Language-System allows a network-accessible authenticated attacker to extract the
SQL injection in Guardian Language-System's designer.php (line 124) allows attackers to extract, modify, or destroy the
Error-based SQL injection in Guardian language-system's subtitles.php exposes full database contents to low-privileged a
Error-based SQL injection in Guardian Language-System exposes the full database to low-privileged authenticated attacker
Error-based SQL injection in Guardian language-system's text_file.php exposes the full database to extraction via a triv
SQL injection in Guardian language-system's media.php endpoint allows low-privilege authenticated attackers to extract t
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection. Rated high severity (CVSS 7
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today