An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts, and… (CVE-2026-52021)

CVE-2026-52021 describes an information disclosure vulnerability in code100xDevs 100xdevs CMS v1.0. The flaw allows remote attackers to access sensitive information via specific source files: src/middleware.ts and src/app/api/mobile/search/route.ts. The vulnerability is exploitable over the network without authentication or user interaction, leading to a high confidentiality impact. There is no indication of integrity or availability impact. No patch or remediation information is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthorized remote attackers to obtain sensitive information from the affected CMS, potentially leading to data leakage. The confidentiality impact is high, but there is no impact on integrity or availability. This could expose sensitive internal data or configuration details that might aid further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict external access to the affected components if possible and monitor for unusual access patterns. Avoid exposing the vulnerable endpoints publicly.