The Hytale Modding Wiki, a platform for hosting documentation and wikis related to Hytale mods, contains an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-32736. This vulnerability arises from missing authorization checks when accessing mod pages, allowing any authenticated user to retrieve sensitive personal information of mod authors, such as full names and email addresses. The flaw exists in all versions prior to 1.0.0. Exploitation is straightforward: an attacker needs only to create an account and navigate to a mod's page using its slug, without requiring additional privileges or user interaction. The vulnerability affects confidentiality but does not impact data integrity or system availability. The CVSS 3.1 base score is 4.3, reflecting a medium severity due to ease of exploitation and limited impact scope. The issue was publicly disclosed on March 18, 2026, and fixed in version 1.0.0 of the wiki software. No known active exploits have been reported. This vulnerability is classified under CWE-862 (Missing Authorization).

The primary impact of CVE-2026-32736 is the unauthorized disclosure of personally identifiable information (PII) of mod authors, including full names and email addresses. This exposure can lead to privacy violations, targeted phishing attacks, social engineering, and potential harassment of affected individuals. While the vulnerability does not compromise system integrity or availability, the leakage of sensitive data can damage user trust and the reputation of the Hytale Modding Wiki platform. Organizations relying on this wiki for mod documentation may face compliance issues with data protection regulations such as GDPR if personal data is exposed without consent. The ease of exploitation—requiring only a registered account—broadens the potential attacker base, increasing the risk of widespread data harvesting.

To mitigate this vulnerability, organizations and users should upgrade the Hytale Modding Wiki to version 1.0.0 or later, where proper authorization checks have been implemented. In addition, administrators should audit access controls to ensure that sensitive author information is only accessible to authorized personnel. Implementing role-based access control (RBAC) or attribute-based access control (ABAC) can help enforce stricter permissions. Monitoring and logging access to mod pages can detect unusual access patterns indicative of data scraping. User education about phishing risks related to exposed email addresses is also advisable. If upgrading immediately is not feasible, consider temporarily restricting account creation or limiting access to mod pages until the patch is applied. Finally, review and update privacy policies to inform users about data handling practices and potential risks.