CVE-2026-7166: API Information Disclosure Vulnerability

CVE-2026-7166 Overview

CVE-2026-7166 is a sensitive information disclosure vulnerability tracked under [CWE-200]. The application exposes personal data through its API without adequate access controls. Specifically, the API returns the contents of the email and telefon fields to unauthenticated callers. The same exposure exists in the local database, which contains records on minors and municipal users. An unauthenticated remote attacker reachable over the network can harvest this data at scale.

According to the INCIBE Security Notice, the issue affects the Assassin Game application by Gaudire.

Critical Impact
Unauthenticated network attackers can read email addresses, phone numbers, and records of minors and municipal users directly from the exposed API and database.

Affected Products

Assassin Game by Gaudire (per INCIBE advisory)
API endpoints returning the email and telefon fields
Local application database storing user records, including minors and municipal users

Discovery Timeline

2026-06-22 - CVE-2026-7166 published to the National Vulnerability Database (NVD)
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-7166

Vulnerability Analysis

The vulnerability is an information exposure flaw classified as [CWE-200]. The API serializes user records and returns the email and telefon fields in responses accessible without authentication. The underlying database stores the same fields in cleartext and is reachable in a way that does not enforce access restrictions. Because the data set includes records on minors and municipal users, the impact extends to populations that warrant stronger handling under privacy regulations.

No authentication, user interaction, or special privileges are required to retrieve the data. The attack is performed over the network against the exposed API surface.

Root Cause

The root cause is the absence of access control and data minimization at the API layer. Endpoints return personal identifiers (email, telefon) that should be restricted to authenticated, authorized callers or excluded from responses entirely. The local database compounds the issue by storing sensitive records without segmentation or protection appropriate for minors and municipal user data.

Attack Vector

An unauthenticated remote attacker issues HTTP requests to the exposed API endpoints and parses the returned JSON or equivalent response payload. Because the fields are present in standard responses, enumeration of identifiers or sequential record retrieval can be used to dump the full user set. Direct access to the database, where reachable, yields the same data without traversing the API.

No verified exploitation code has been published. Refer to the INCIBE Security Notice for vendor and coordinator guidance.

Detection Methods for CVE-2026-7166

Indicators of Compromise

High volumes of unauthenticated requests to API endpoints that return user records
API responses containing the email and telefon fields delivered to anonymous clients
Sequential or enumerated identifier patterns in access logs targeting user resources
Outbound database queries returning bulk user rows from non-application sources

Detection Strategies

Inspect API gateway and web server logs for unauthenticated GET requests to user-related endpoints
Apply data loss prevention rules that flag response payloads containing email addresses and phone numbers leaving the application
Correlate spikes in 200-OK responses on user endpoints with absence of authentication headers or session cookies

Monitoring Recommendations

Enable verbose API access logging with client IP, endpoint, authentication state, and response size
Forward application, API, and database audit logs to a centralized analytics platform for retention and correlation
Alert on database connections originating outside expected application service accounts or hosts

How to Mitigate CVE-2026-7166

Immediate Actions Required

Restrict the affected API endpoints behind authentication and authorization checks before exposing them to the network
Remove the email and telefon fields from responses that do not require them, applying response field allow-lists
Restrict network reachability of the local database to the application tier only and rotate any credentials suspected of exposure
Notify affected users in line with applicable privacy obligations where exposure of minors' or municipal users' data is confirmed

Patch Information

No vendor patch reference is listed in the NVD record at publication. Monitor the INCIBE Security Notice for updates from the vendor regarding fixed versions and remediation guidance.

Workarounds

Place the API behind a reverse proxy or API gateway that enforces authentication on every route
Apply a web application firewall rule that blocks anonymous access to endpoints returning user records
Filter or mask the email and telefon fields at the gateway layer until a code-level fix is available
Isolate the database on a private network segment and disable any externally reachable listeners

bash

# Example: block unauthenticated access to user API endpoints at an Nginx reverse proxy
location /api/users {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://app_backend;
}