CVE-2026-92759— SecObserve before 1.59.1 Information Disclosure via API Configuration
Quick assessment
Affected
SecObserve SecObserve
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SecObserve 在 1.59.1 版本之前存在信息泄露漏洞。该漏洞位于 中，由于未能从 API 配置响应中移除 字段，导致只读权限的产品成员可以通过标准 REST 端点获取已配置的扫描器或集成服务账户的明文（解密后）basic-auth 密码。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1552.001 · Credentials In Files
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92759
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SecObserve before 1.59.1 Information Disclosure via API Configuration
Source: CVE Program / CVE List V5
Vulnerability Description
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SecObserve | SecObserve | 1.17.0 ~ 1.59.1 | - |
|
II. Public POCs for CVE-2026-92759
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92759
请登录查看更多情报信息。
Other References for CVE-2026-92759 (4)
-
-
🔗 Release 1.59.1 · SecObserve/SecObserve · GitHub release-notes
-
🔗 API Configuration basic_auth_password exposed to product members without edit permission · Advisory · SecObserve/SecObserve · GitHub Read full article third-party-advisory vendor-advisory
-
IV. Related Vulnerabilities
Same weakness: CWE-522
-
CVE-2026-89064
All-in-One WP Migration and Backup <= 7.110 - Unauthenticate -
CVE-2026-20234
Cisco Identity Services Engine Hardening Release - Insuffien -
CVE-2026-92256
Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure -
CVE-2026-76871
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure -
CVE-2026-76859
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure
V. Comments for CVE-2026-92759
No comments yet