CVE-2026-108810: Information Disclosure in tsi-coop tsi-dpdp-cms

This vulnerability affects the tsi-dpdp-cms product from tsi-coop, specifically versions 0.5.0 through 0.5.2. It involves an information disclosure flaw in the JSON Schema Validation component triggered by manipulating the _func argument. The attack vector is remote and requires no privileges or user interaction. The vendor responded promptly and released version 0.5.3 to fix the issue. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

Successful exploitation of this vulnerability allows an attacker to remotely disclose sensitive information from the affected system without requiring authentication or user interaction. This could potentially aid further attacks or reconnaissance but does not directly allow system compromise or denial of service.

Upgrade the tsi-dpdp-cms product to version 0.5.3 or later, as this version contains the official fix for the vulnerability. The vendor has released this update promptly after being notified. No additional mitigation steps are indicated by the vendor.