CVE-2026-86817

{
  "etk_id": "ETK-2026-604",
  "cve_id": "CVE-2026-86817",
  "display_id": "CVE-2026-86817",
  "ghsa_id": "GHSA-qpw5-3rj5-433c",
  "euvd_id": "EUVD-2026-92074",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated data disclosure in Five Star Business Profile and Schema",
  "summary": "Versions before 2.4.0 can allow users with Author-level access or higher to cause sensitive site data to appear in public schema output. Exposed information may include password hashes and site option values, which can then be read by unauthenticated visitors.",
  "mitigation": "Update Five Star Business Profile and Schema to version 2.4.0 or later. Review public schema output and rotate credentials or secrets if sensitive values may have been exposed.",
  "vendor": null,
  "product": "Five Star Business Profile and Schema",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.3.20, < 2.4.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.4.0"
      ],
      "package_name": "Five Star Business Profile and Schema",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 4.9,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0023,
  "epss_percentile": 0.1345,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 45.16892618333333,
  "t0_at": "2026-10-04T06:00:23.722000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-05T00:42:05.348040+00:00",
      "days": 0.7789540050925926,
      "is_lower_bound": false,
      "measured_at": "2026-10-04T06:00:23.722000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-04T06:00:23.722000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-04T06:00:23.722000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86817"
    }
  }
}