CVE-2026-25729: DeepAudit Information Disclosure Flaw

CVE-2026-25729 Overview

DeepAudit is a multi-agent system for code vulnerability discovery. In version 3.0.4 and earlier, an improper access control vulnerability exists in the /api/v1/users/ endpoint that allows any authenticated user to enumerate all users in the system and retrieve sensitive information including email addresses, phone numbers, full names, and role information. This Broken Access Control vulnerability (CWE-863) exposes organizations to significant data privacy risks and potential regulatory compliance violations.

Critical Impact

Any authenticated user can access and enumerate sensitive personal information of all system users, leading to privacy breaches and potential social engineering attacks.

Affected Products

• DeepAudit versions 3.0.4 and earlier
• DeepAudit multi-agent code vulnerability discovery system

Discovery Timeline

• 2026-02-06 - CVE-2026-25729 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25729

Vulnerability Analysis

This vulnerability stems from insufficient authorization checks on the user enumeration endpoint. The /api/v1/users/ API endpoint was designed to list users with support for pagination, search, and filtering capabilities. However, the endpoint only verified that a user was authenticated, without checking whether the authenticated user had the appropriate privileges (such as superuser or administrator status) to access sensitive user data.

The flaw allows any authenticated user—regardless of their assigned role—to retrieve comprehensive user listings that include personally identifiable information (PII) such as email addresses, phone numbers, full names, and role assignments. This represents a horizontal privilege escalation where low-privilege users can access data intended only for administrators.

Root Cause

The root cause is an improper authorization check in the users.py endpoint handler. The original code used deps.get_current_user as a dependency, which only validates that a request comes from an authenticated user. This dependency does not verify whether the user has elevated privileges necessary to access sensitive user enumeration functionality.

Attack Vector

An attacker with valid low-privilege credentials can exploit this vulnerability by making authenticated HTTP requests to the /api/v1/users/ endpoint. The attack requires network access and valid authentication credentials but does not require any special privileges. The attacker can utilize the built-in search, role filtering, and status filtering parameters to efficiently extract targeted user information.

# Security patch showing the fix (backend/app/api/v1/endpoints/users.py)
     search: Optional[str] = Query(None, description="搜索关键词"),
     role: Optional[str] = Query(None, description="角色筛选"),
     is_active: Optional[bool] = Query(None, description="状态筛选"),
-    current_user: User = Depends(deps.get_current_user),
+    current_user: User = Depends(deps.get_current_active_superuser),
 ) -> Any:
     """
     获取用户列表（支持分页、搜索、筛选）

Source: GitHub DeepAudit Commit

The fix changes the dependency from get_current_user to get_current_active_superuser, ensuring that only users with superuser privileges can access the user enumeration endpoint.

Detection Methods for CVE-2026-25729

Indicators of Compromise

• Unusual volume of requests to the /api/v1/users/ endpoint from non-administrative accounts
• API access logs showing user enumeration queries from accounts that typically do not require such access
• Evidence of systematic user data harvesting through paginated requests or search parameter abuse

Detection Strategies

• Monitor API access logs for requests to /api/v1/users/ from users without administrative roles
• Implement anomaly detection for user accounts making bulk user enumeration requests
• Review audit logs for patterns indicating systematic data extraction from the users endpoint

Monitoring Recommendations

• Enable detailed logging for all API endpoints handling sensitive user data
• Configure alerts for failed authorization attempts and unusual access patterns
• Implement rate limiting on user enumeration endpoints to slow potential data harvesting attempts

How to Mitigate CVE-2026-25729

Immediate Actions Required

• Update DeepAudit to a version newer than 3.0.4 that includes the security patch
• Review access logs to identify any potential exploitation of this vulnerability
• Audit user accounts for any unauthorized access or data extraction
• Notify affected users if evidence of data exposure is discovered

Patch Information

A security patch is available that addresses this vulnerability by changing the authorization dependency from get_current_user to get_current_active_superuser. Organizations should apply commit b2a3b26579d3fdbab5236ae12ed67ae2313175fd or update to the latest version of DeepAudit. For detailed patch information, refer to the GitHub Security Advisory GHSA-vmmm-48w2-q56q.

Workarounds

• Implement network-level access controls to restrict access to the /api/v1/users/ endpoint to trusted administrative networks
• Deploy a web application firewall (WAF) rule to block non-administrative users from accessing the users endpoint
• Temporarily disable the user enumeration endpoint if not critical for operations until the patch can be applied

# Example: Restrict access to the users endpoint via reverse proxy (nginx)
location /api/v1/users/ {
    # Allow only from admin network
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://backend;
}