CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
baseThe product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (251)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-0482US | critical9.1OT high | Exploit | ||
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | ||||
| CVE-2023-50719US | high7.5OT high | — | ||
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password… | ||||
| CVE-2018-4110US | critical9.8 | Exploit | ||
An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Web App" component. It allows remote attackers to bypass intended restrictio… | ||||
| CVE-2023-36052US | high8.6 | — | ||
Azure CLI REST Command Information Disclosure Vulnerability | ||||
| CVE-2025-34441US | high7.5 | Exploit | ||
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last… | ||||
| CVE-2023-36018US | critical9.8 | — | ||
Visual Studio Code Jupyter Extension Spoofing Vulnerability | ||||
| CVE-2009-3818US | high10.0 | — | ||
Unspecified vulnerability in the session handling feature in freeCap CAPTCHA (sr_freecap) extension 1.2.0 and earlier for TYPO3 has unknown impact and attack vectors. | ||||
| CVE-2023-38880US | critical9.8 | — | ||
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database… | ||||
| CVE-2022-0155US | medium6.5 | Exploit | ||
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor | ||||
| CVE-2024-49765US | critical9.1 | — | ||
Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse… | ||||
| CVE-2021-31590US | high8.8 | — | ||
PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication a… | ||||
| CVE-2022-2921US | high8.8 | — | ||
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administ… | ||||
| CVE-2024-30056US | medium5.4 | Exploit | ||
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | ||||
| CVE-2026-50657US | medium5.5 | Exploit | ||
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally. | ||||
| CVE-2025-62644US | high7.7 | — | ||
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users. | ||||
| CVE-2025-59843US | medium5.3 | Exploit | ||
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. Th… | ||||
| CVE-2021-3980US | high7.5 | — | ||
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor | ||||
| CVE-2026-56171US | high7.5 | — | ||
Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-48615US | high7.5 | — | ||
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
When proxy credentials are embedded in the proxy URL, they may… | ||||
| CVE-2026-26237US | high7.5OT elevated | — | ||
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthoriz… | ||||
03
attack patterns (4)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan