CVE-2026-86834

{
  "etk_id": "ETK-2026-597",
  "cve_id": "CVE-2026-86834",
  "display_id": "CVE-2026-86834",
  "ghsa_id": "GHSA-cr6m-q4jq-r64m",
  "euvd_id": "EUVD-2026-91940",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated debug log disclosure in MetForm",
  "summary": "MetForm versions earlier than 4.3.1 can leave diagnostic output accessible from the web root when the HubSpot Forms integration is enabled. An unauthenticated attacker may read recorded upstream API response data, including cookies and correlation identifiers, after form activity generates the file.",
  "mitigation": "Upgrade MetForm to version 4.3.1 or later. Until upgraded, disable the HubSpot Forms integration and restrict web access to diagnostic files in the site root.",
  "vendor": null,
  "product": "MetForm",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.2.1, < 4.3.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.3.1"
      ],
      "package_name": "MetForm",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 3.7,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss_score": 0.0018,
  "epss_percentile": 0.0693,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 30.077557716666668,
  "t0_at": "2026-10-03T06:00:26.480000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-04T22:42:03.706366+00:00",
      "days": 1.6955697496064814,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:26.480000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T06:00:26.480000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:26.480000+00:00",
      "url": "https://github.com/advisories/GHSA-cr6m-q4jq-r64m"
    }
  }
}