CVE-2026-97314

{
  "etk_id": "ETK-2026-1941",
  "cve_id": "CVE-2026-97314",
  "display_id": "CVE-2026-97314",
  "ghsa_id": "GHSA-52ff-p635-qf9p",
  "euvd_id": "EUVD-2026-103260",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated link metadata disclosure in ThirstyAffiliates",
  "summary": "ThirstyAffiliates versions before 3.12.1 inadequately validate objects handled by link redirect tracking. An unauthenticated attacker can expose destination URLs for unpublished affiliate links and add misleading click statistics without needing an account.",
  "mitigation": "Update ThirstyAffiliates to version 3.12.1 or later.",
  "vendor": null,
  "product": "ThirstyAffiliates",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.12.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.12.1"
      ],
      "package_name": "ThirstyAffiliates",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 6.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss_score": 0.0018,
  "epss_percentile": 0.0672,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 37.0238435,
  "t0_at": "2026-10-17T06:00:15.251000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T07:19:10.976890+00:00",
      "days": 1.0548116422453704,
      "is_lower_bound": false,
      "measured_at": "2026-10-17T06:00:15.251000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-17T06:00:15.251000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-17T06:00:15.251000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97314"
    }
  }
}