CVE-2026-122154 Details
Description
A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
An information disclosure vulnerability exists in Purocean Yank Note version 3.93.0. The issue arises in the Settings Endpoint, specifically within the 'config.getAll' function of 'src/main/server/index.ts'. This vulnerability allows unauthenticated users to access sensitive information, including the JWT signing key, which can be exploited to forge admin tokens. The flaw can be exploited remotely, and the details of the vulnerability have been made public. The issue has been addressed in version 3.93.1, and users are advised to upgrade.
Users should upgrade to Purocean Yank Note version 3.93.1, which removes the sensitive information from the API response and enforces proper authentication. The updated version is available on the Purocean Yank Note GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df | [email protected] | Source CodeVendor |
| https://github.com/purocean/yn/issues/532 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/purocean/yn/pull/535 | [email protected] | Issue TrackingVendor |
| https://github.com/purocean/yn/releases/tag/v3.93.1 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-122154 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1028031 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431155 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/431155/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| purocean Yank Note | 3.93.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |