EUVD-2026-38236
GHSA-qvr5-4jwr-6hcv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated API returns PII with no user interaction, giving AV:N/AC:L/PR:N/UI:N; only confidentiality is impacted, so C:H and I:N/A:N.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and phone number data from the ‘email’ and ‘telefon’ fields. This vulnerability is also present in the local database, as it contains accessible sensitive information such as data on minors and municipal users. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain access to sensitive information and data.
AnalysisAI
Sensitive information disclosure in Gaudire's Assassin Game application allows unauthenticated remote attackers to retrieve personally identifiable information (PII) - including email addresses and phone numbers - through the application's API. The exposure also extends to the local database, which holds data on minors and municipal users, significantly elevating privacy and regulatory risk. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.2 and CWE-200 classification mark this as a high-priority data exposure issue.
Technical ContextAI
The affected product is Gaudire's Assassin Game (cpe:2.3:a:gaudire:assassin_game), a gaming/event-management application that maintains user profile data including the 'email' and 'telefon' (telephone) fields. The root cause falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the API endpoints return personal data fields without applying authentication, authorization, or field-level filtering. The same data is reportedly accessible through the local database layer, suggesting that data-protection controls (encryption-at-rest, access scoping, or minimum-necessary projection in queries) are not applied consistently across the data plane.
RemediationAI
No vendor-released patch identified at time of analysis; defenders should consult the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-assassin-game-gaudire for vendor coordination status and any released fix. Until a patched build is available, compensating controls include placing the Assassin Game API behind an authenticating reverse proxy or WAF that rejects unauthenticated requests to user-data endpoints (trade-off: legitimate clients must be updated to present credentials), restricting database access to the minimum service account and rotating any data already presumed leaked, and applying field-level access controls so the 'email' and 'telefon' fields are stripped from API responses unless the caller is authorized (trade-off: may break self-service UI features that legitimately read those fields). Given the presence of minors' data, operators should also evaluate notification obligations under GDPR/LOPDGDD.
More in Assassin Game
View allMultiple chained vulnerabilities in Gaudire's Assassin Game platform allow an authenticated low-privileged player to tam
Email validation bypass in Gaudire's Assassin Game permits registration with arbitrary or non-existent email addresses,
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today