CVE-2026-36719 is an information disclosure vulnerability affecting AgentChat version 2.3.0. The vulnerability exists in the /api/v1/user/info API endpoint, which improperly exposes sensitive user data such as SHA256 password hashes to unauthenticated attackers who can enumerate user IDs. This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with no required privileges or user interaction for exploitation. No patch or official fix has been documented as of the published date.

Successful exploitation allows unauthenticated attackers to obtain sensitive information, specifically SHA256 password hashes of users, which could facilitate further attacks such as offline password cracking. The integrity and availability of the system are not impacted. The exposure of password hashes represents a significant confidentiality breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/v1/user/info endpoint and implement rate limiting or other controls to prevent user ID enumeration. Monitor for unusual access patterns targeting this endpoint.