This vulnerability (CVE-2026-54821) involves the insertion of sensitive subscriber information into data sent by the Visual Link Preview product from Bootstrapped Ventures, affecting versions up to 2.3.1. It is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data). The CVSS 3.1 base score is 7.4, indicating high severity, with network attack vector, low attack complexity, requiring low privileges and no user interaction. The scope is changed, and impacts include low confidentiality, integrity, and availability impacts. No known exploits are reported, and no patch or official remediation level has been published as of now.

The vulnerability may expose sensitive subscriber data to unauthorized parties, potentially compromising confidentiality. Integrity and availability impacts are also indicated but assessed as low. The vulnerability could be exploited remotely with low complexity and minimal privileges, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Avoid deploying affected versions in sensitive environments until a fix is available.