CVE-2026-42673 is a high-severity vulnerability (CVSS 7.5) in Logtivity's Activity Logs and related products that allows sensitive information to be inserted into data sent by the application. This vulnerability falls under CWE-201, indicating that sensitive data may be exposed unintentionally through transmitted data. It affects versions through 3.3.6. The vulnerability can be exploited remotely without authentication or user interaction, impacting confidentiality but not integrity or availability. There is currently no official remediation or patch available from the vendor, and no known exploits have been observed in the wild.

The vulnerability allows an attacker to retrieve embedded sensitive data from the Logtivity activity logs or user tracking data, potentially exposing confidential information. The impact is limited to confidentiality loss; integrity and availability are not affected. Because the attack vector is network-based and requires no privileges or user interaction, the vulnerability could be exploited remotely if the affected service is accessible. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor-provided mitigation or temporary fix is currently available. Avoid exposing the affected service to untrusted networks to reduce risk.