CVE Intelligence
Analysis AI-assisted

CVE-2026-7166: Sensitive data exposure in API (CWE-200)

CVE-2026-7166 describes an API that exposes email and phone number values, and a local database with the same weakness that contains accessible data on minors and municipal users. The CNA rates it 9.2 under CVSS 4.0 and reports high confidentiality impact for an unauthenticated remote attacker. The record shows no KEV listing, no affected versions and no fixes, so scope and remediation status are unknown.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7166 is classified as CWE-200, Exposure of Sensitive Information. According to the record, an API exposes email and phone number values from the 'email' and 'telefon' fields, and the same weakness appears in a local database that holds accessible sensitive information, including data on minors and municipal users.

Impact

  • The CNA's CVSS 4.0 vector rates confidentiality impact as high, with integrity and availability impact set to none.
  • The record states that an unauthenticated remote attacker could gain access to sensitive information and data.
  • Exposure of personal data about minors raises privacy and regulatory concerns for any operator of the affected system.

Affected products and versions

  • The record does not list affected products or versions, so the scope cannot be determined from the available data.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Operators of the affected API and database should restrict access to personal fields, require authentication and authorization for those endpoints, and stop returning unneeded personal data.
  • Give priority to records involving minors, assess applicable data protection obligations, and limit access to the affected database.
  • Follow the advisory published by INCIBE-CERT and any vendor guidance released later.

Detection guidance

  • Review API logs for unauthenticated requests whose responses include email or phone fields.
  • Audit access to the local database for unexpected reads of personal data, especially records tied to minors.

Limitations of the available information

  • The record contains no product name, vendor, affected versions or fixed versions.
  • The CVSS 4.0 score of 9.2 comes from the CNA. The NVD status is Deferred, and EPSS and SSVC data are absent.

Frequently asked questions

What data is exposed by CVE-2026-7166?

According to the record, the API exposes email and phone number values from the 'email' and 'telefon' fields. The local database with the same weakness contains accessible data on minors and municipal users.

Is CVE-2026-7166 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record does not list affected or fixed versions, so this information is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.