CVE-2026-46458
Credential exposure in ICU Scandinavia Boomerang
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 15, 2026
- Updated
- Jul 15, 2026
- Reserved
- May 14, 2026
Description
ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This issue has been fixed in version 2.4.18.029
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-522 Insufficiently Protected Credentials
Affected Products
| Product | Versions |
|---|---|
BoomerangICU Scandinavia |
|
References
- https://cert.pl/posts/2026/07/CVE-2026-46458third-party-advisory
- https://icuscandinavia.se/boomerang-quality-assurance-lab/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.