---
id: CVE-2026-12258
title: Inadequate access control in Hiperdino’s REST v1.0 API
summary: >-
  Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint
  ‘customer/check’ could allow an authenticated attacker to enter a telephone
  number or an email address. When the value entered belongs to a registered
  customer, …
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'
cwe:
  - CWE-284
vendor: Hiperdino
product: REST API
affected:
  - rest_api 1.0
published: '2026-09-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:21:49.497'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12258'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-hiperdino-rest-api
    label: cve-coordination@incibe.es
tags:
  - nvd
  - cve.org
epss: 0.004
epssPercentile: 0.31373
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-14T14:18:13.019841Z'
cvssSource: cna
ingestedAt: '2026-09-14T15:23:07.421Z'
---

## Overview

Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling. Successful exploitation of this vulnerability could allow a remote attacker to enumerate a user’s contact details, although this would require obtaining a valid static bearer token, constituting an information disclosure vulnerability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.