Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive… (CVE-2026-110889)

CVE-2026-110889 describes a vulnerability in Gantry 5 Framework where error messages generated by the system may expose sensitive information embedded within the application. This exposure can allow an attacker to retrieve sensitive data without authentication or user interaction. The vulnerability affects versions up to and including 5.6.4. The CVSS 3.1 vector indicates it is remotely exploitable with low complexity and no privileges required, impacting confidentiality only.

The vulnerability allows an unauthenticated attacker to retrieve sensitive embedded data through error messages, potentially leading to information disclosure. There is no impact on data integrity or system availability. The exposure of sensitive information could facilitate further attacks or data breaches depending on the nature of the disclosed data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, monitor vendor communications for updates and consider restricting access to error messages or disabling detailed error reporting in production environments if feasible.