EUVD-2026-44666
GHSA-pc6h-25p2-384f
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Static-HTTP file retrieval is network-reachable and unauthenticated (AV:N/PR:N/UI:N/AC:L); impact is plaintext credential disclosure only, so C:H with I:N/A:N; vendor's AV:A is noted as a possible exposure limit.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This issue has been fixed in version 2.4.18.029
AnalysisAI
Information disclosure in ICU Scandinavia Boomerang (versions prior to 2.4.18.029) lets an unauthenticated attacker retrieve plaintext service-account and SMTP credentials by requesting specific XML configuration files served as static content from the webroot. The exposed credentials enable follow-on compromise of connected mail and service accounts. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the vendor CVSS 4.0 base score is 7.1 (High).
Technical ContextAI
Boomerang is a quality-assurance/lab application from ICU Scandinavia that stores integration credentials - including SMTP and service-account logins - in XML files. The root cause is CWE-522 (Insufficiently Protected Credentials): sensitive configuration files are placed inside the web server's document root and served directly over static HTTP without access control or storage in a protected location outside the webroot. Because the files are plaintext XML and reachable at predictable paths, any client that can reach the web listener can read them. The affected product is identified by CPE cpe:2.3:a:icu_scandinavia:boomerang:*:*:*:*:*:*:*:* across all versions below the fix.
RemediationAI
Vendor-released patch: upgrade to Boomerang 2.4.18.029, which remediates the exposure. Until the upgrade is applied, restrict who can reach the web listener: place the application behind network access controls or a VPN so the webroot is not reachable from untrusted networks, and block direct HTTP access to the credential XML files at the web-server/reverse-proxy layer (deny requests to the specific XML paths under the webroot) - note this may break any component that legitimately fetches those files, so validate application function after adding the rule. As a stronger control, move credential files outside the document root and rotate any SMTP and service-account credentials that may already have been exposed, since a patch does not invalidate previously leaked secrets. Refer to the CERT-PL advisory at https://cert.pl/posts/2026/07/CVE-2026-46458 for details.
An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. Rated critical severity
An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. Rated medium severity (C
Missing authorization on device receiver endpoints in ICU Scandinavia Boomerang exposes facility and quality-assurance i
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today