{"id":"CVE-2026-12258","revision":"ea3969572bd8415bb4f0bc6a5c459ed7","records":[{"revision":"ea3969572bd8415bb4f0bc6a5c459ed7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-12258","aliases":[],"title":"Inadequate access control in the Hiperdino REST API","description":"Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling. Successful exploitation of this vulnerability could allow a remote attacker to enumerate a user’s contact details, although this would require obtaining a valid static bearer token, constituting an information disclosure vulnerability.","state":0,"publishedAt":"2026-09-14T12:11:13.182+00:00","modifiedAt":"2026-09-28T14:21:19.164+00:00","affected":[{"ecosystem":"Vendor product","name":"REST API","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hiperdino\",\n                    \"product\": \"REST API\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":9.2,"severity":"CRITICAL"}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-hiperdino-rest-api"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12258","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-12258","identifiers":["CVE-2026-12258"]},"retained":false,"historicalAffected":[]}],"coverage":[]}