CVE-2026-48771 describes an information exposure vulnerability (CWE-200) in the ishankportfolio website. Before version 1.0.1, contact form data stored in a client-side database was vulnerable due to improperly secured database credentials and permissive access control policies. This allowed unauthorized actors to read or modify sensitive form submission data containing PII. The vulnerability has been addressed in version 1.0.1 by improving database security and access controls. Mitigations include disabling public read/write access, rotating exposed API keys, enforcing authenticated database policies, and moving sensitive operations to secure backend functions.

Unauthorized users could access and potentially modify personally identifiable information submitted via the website's contact form, including names, email addresses, phone numbers, and messages. This exposure compromises user privacy and could lead to misuse of sensitive data. The vulnerability does not affect system availability but has a high confidentiality impact.

A fix is available in version 1.0.1. Users should upgrade to this version to resolve the vulnerability. For those unable to upgrade immediately, recommended mitigations include disabling public read/write access to the database, rotating any exposed API keys, restricting database access policies to authenticated requests only, moving sensitive operations to secure backend or serverless functions, and monitoring database activity logs for suspicious access.