CVE-2026-42419: CWE-201 Insertion of Sensitive Information Into Sent Data in SwishFolio Swish Migrate and Backup

This vulnerability, identified as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects Swish Migrate and Backup versions up to 1.4.0. It allows unauthenticated attackers to cause sensitive data to be exposed by inserting it into data sent by the application. The CVSS 3.1 base score is 5.9, reflecting network attack vector with high attack complexity and no privileges or user interaction required. The impact is high confidentiality loss without integrity or availability impact. No known exploits are reported, and no vendor patch or advisory information is provided.

The vulnerability leads to exposure of sensitive information without requiring authentication. This confidentiality breach could allow attackers to access sensitive data transmitted by the application. There is no impact on data integrity or availability. The attack complexity is high, which may limit exploitation likelihood.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting network access to the affected application and monitor for unusual data transmissions involving sensitive information.