CVE-2026-105707: Information Exposure Through Error Message in uptrace

This vulnerability in uptrace up to version 2.1.0-beta.8 involves the Login function in pkg/org/user_handler.go, where improper handling of error messages leads to information exposure. The flaw can be exploited remotely without authentication, potentially revealing sensitive information. The issue was reported early to the project, but no fix or official response has been issued. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can remotely trigger error messages that leak information, which could aid in further attacks or reconnaissance. There is no indication of privilege escalation, integrity, or availability impact. The vulnerability's medium severity reflects the moderate risk posed by information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected Login function or implementing additional error handling to avoid information leakage.