{"id":"CVE-2026-12258","title":"Inadequate access control in Hiperdino’s REST v1.0 API","summary":"Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, …","severity":"critical","cvss":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","cwe":["CWE-284"],"vendor":"Hiperdino","product":"REST API","affected":["rest_api 1.0"],"published":"2026-09-14","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:21:49.497","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12258","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-hiperdino-rest-api","label":"cve-coordination@incibe.es"}],"tags":["nvd","cve.org"],"epss":0.004,"epssPercentile":0.34039,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-14T14:18:13.019841Z"},"cvssSource":"cna","ingestedAt":"2026-09-14T15:23:07.421Z","slug":"CVE-2026-12258","body":"## Overview\n\nInadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling. Successful exploitation of this vulnerability could allow a remote attacker to enumerate a user’s contact details, although this would require obtaining a valid static bearer token, constituting an information disclosure vulnerability.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":50.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}