CVE-2026-52698 is a vulnerability classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) affecting PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget up to version 4.2.3. This issue allows sensitive subscriber data to be inserted into data sent by the application, which may lead to exposure of confidential information. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor, and the product is not a cloud service. No known active exploitation has been reported.

The vulnerability can lead to exposure of sensitive subscriber data, potentially compromising confidentiality, integrity, and availability of the affected system. This could result in unauthorized access to subscriber information and manipulation or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been provided, users should monitor vendor communications for updates. No specific mitigation steps are currently documented.