CVE-2026-104385: CWE-201 Insertion of Sensitive Information Into Sent Data in Adrian Tobey Groundhogg

This vulnerability, identified as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects Groundhogg versions up to 4.8.3. It allows unauthenticated attackers to gain access to sensitive data because the application inserts sensitive information into data sent without proper protection. The CVSS 3.1 base score is 7.5, reflecting a network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

An unauthenticated attacker can access sensitive information from Groundhogg instances running affected versions, potentially leading to data leakage. The confidentiality impact is high, but integrity and availability are not affected. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor the vendor's communications for updates and apply any official patches once available.