CWE-200 10082 CVEs MITRE definition ↗

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Overview

CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Applicable platforms

Kind Name Class Prevalence OS / CPE
language — Not Language-Specific Undetermined —
technology — Not Technology-Specific Undetermined —
technology — Web Based Undetermined —
technology — Mobile Undetermined —

Related CVEs in this database

These CVEs are mapped to this weakness in this database and kept for traceability and search.

CVE Published Summary
CVE-2026-12117 2026-06-16 Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not aut…
CVE-2026-50870 2026-06-15 An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitive information via a crafted GET request.
CVE-2026-39007 2026-06-15 An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component.
CVE-2026-8385 2026-06-15 The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve …
CVE-2026-12203 2026-06-15 A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215. This affects an unknown part of the file /api/research/agents.csv of the component Research Export. Perform…
CVE-2026-49397 2026-06-12 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumera…
CVE-2026-47124 2026-06-12 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server…
CVE-2026-54396 2026-06-12 An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker…
CVE-2026-47264 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializer#tag…
CVE-2026-47263 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish ca…
CVE-2026-45085 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, four authorization/disclo…
CVE-2026-44786 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public ca…
CVE-2026-44785 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper o…
CVE-2026-44784 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, group owners who are not …
CVE-2026-44782 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer decla…
CVE-2026-44780 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSeria…
CVE-2026-44779 2026-06-12 Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, bot debug endpoints discl…
CVE-2026-53725 2026-06-12 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.5, apps that enable MFA and deny get on the _Us…
CVE-2026-6046 2026-06-12 Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot registration belongs to a bot account, which allow…
CVE-2026-3433 2026-06-12 Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel whi…

Previous names

  • Information Leak (Information Disclosure) (2009-12-28)
  • Information Exposure (2020-02-24)

Content submission

Name
PLOVER
Date
2006-07-19
Version
Draft 3

Content modifications

Date Name Version Importance Comment
2008-07-01 Eric Dalci 1.0 — updated Time_of_Introduction
2008-09-08 CWE Content Team 1.0 — updated Likelihood_of_Exploit, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
2008-10-14 CWE Content Team 1.0.1 — updated Description
2009-12-28 CWE Content Team 1.7 — updated Alternate_Terms, Description, Name
2010-02-16 CWE Content Team 1.8 — updated Taxonomy_Mappings
2010-04-05 CWE Content Team 1.8.1 — updated Related_Attack_Patterns
2011-03-29 CWE Content Team 1.12 — updated Description, Relationships
2011-06-01 CWE Content Team 1.13 — updated Common_Consequences
2012-05-11 CWE Content Team 2.2 — updated Related_Attack_Patterns, Relationships
2012-10-30 CWE Content Team 2.3 — updated Potential_Mitigations
2013-02-21 CWE Content Team 2.4 — updated Alternate_Terms, Applicable_Platforms, References
2014-06-23 CWE Content Team 2.7 — updated Related_Attack_Patterns
2014-07-30 CWE Content Team 2.8 — updated Detection_Factors, Relationships
2015-12-07 CWE Content Team 2.9 — updated Relationships
2017-05-03 CWE Content Team 2.11 — updated Related_Attack_Patterns
2017-11-08 CWE Content Team 3.0 — updated References
2019-01-03 CWE Content Team 3.2 — updated Related_Attack_Patterns
2019-06-20 CWE Content Team 3.3 — updated Related_Attack_Patterns, Relationships
2019-09-19 CWE Content Team 3.4 — updated Demonstrative_Examples, Observed_Examples, Relationships
2020-02-24 CWE Content Team 4.0 — updated Applicable_Platforms, Demonstrative_Examples, Description, Name, Observed_Examples, Related_Attack_Patterns, Relationships, Weakness_Ordinalities
2020-06-25 CWE Content Team 4.1 — updated Relationships
2020-08-20 CWE Content Team 4.2 — updated Alternate_Terms, Description, Maintenance_Notes, Related_Attack_Patterns, Relationships
2020-12-10 CWE Content Team 4.3 — updated Potential_Mitigations
2021-07-20 CWE Content Team 4.5 — updated Relationships
2021-10-28 CWE Content Team 4.6 — updated Relationships
2022-10-13 CWE Content Team 4.9 — updated Demonstrative_Examples, Maintenance_Notes, Observed_Examples, References
2023-04-27 CWE Content Team 4.11 — updated References, Relationships
2023-06-29 CWE Content Team 4.12 — updated Mapping_Notes
2023-10-26 CWE Content Team 4.13 — updated Observed_Examples
2024-11-19 CWE Content Team 4.16 — updated Relationships
2025-04-03 CWE Content Team 4.17 — updated Relationships
2025-09-09 CWE Content Team 4.18 — updated Detection_Factors, References
2025-12-11 CWE Content Team 4.19 — updated Applicable_Platforms, Relationships
2026-04-30 CWE Content Team 4.20 — updated Maintenance_Notes, Mapping_Notes

Contributions

Type Name Date Comment
Feedback Nick Johnston 2022-07-11 Identified incorrect language tag in demonstrative example.
cvelogic Threat Intelligence