What is the CVSS score of EUVD-2026-16604?

EUVD-2026-16604 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by EUVD-2026-16604?

Organizations using v.8.0 and face notable risk from CVE-2026-30689, a improper access control vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate EUVD-2026-16604?

Within 7 days: Identify all affected systems running v.8.0 and and apply vendor patches promptly. Monitor vendor channels for patch availability.

N A EUVD-2026-16604

| CVE-2026-30689 MEDIUM

Improper Access Control (CWE-284)

2026-03-27 mitre

GHSA-x4mm-wg99-32fj

Information Disclosure Authentication Bypass N A

4.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 02, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jul 02, 2026 - 20:22 NVD

7.5 (HIGH) 4.3 (MEDIUM)

EUVD ID Assigned

Mar 27, 2026 - 14:30 euvd

EUVD-2026-16604

Analysis Generated

Mar 27, 2026 - 14:30 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access control which leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security.

AnalysisAI

Blog.Admin versions 8.0 and earlier expose sensitive administrator account information through an improper access control vulnerability in the getinfobytoken API endpoint. An attacker possessing a valid authentication token can bypass authorization checks to retrieve confidential administrator credentials and account details, potentially enabling lateral movement or privilege escalation attacks. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability resides in the Blog.Admin application's getinfobytoken API interface, which fails to properly validate that the requester is authorized to access the requested administrator information despite possessing a valid token. This represents a broken access control flaw (CWE category: improper access control) where authentication (token validity) is present but authorization (permission to access specific resources) is missing. The affected product is Blog.Admin (also referenced as Blog.Core via the GitHub repository anjoy8/Blog.Core), a .NET-based blogging platform. The vulnerability allows token holders to enumerate or retrieve administrator account objects they should not have access to, leading to information disclosure of sensitive account metadata.

RemediationAI

Upgrade Blog.Admin to a version later than 8.0 immediately. Consult the vendor's official website at http://blagadmin.com and GitHub repository at https://github.com/anjoy8/Blog.Core for the specific patched version number and installation instructions. Until an upgrade is feasible, restrict API access to the getinfobytoken endpoint to trusted internal networks only, enforce strict token rotation policies to limit the window of exposure if tokens are compromised, and implement rate limiting on token-based API requests to reduce enumeration risk. Monitor administrator account access logs for suspicious token usage patterns.