CVE-2026-46458 Details
Description
ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This issue has been fixed in version 2.4.18.029
A vulnerability in ICU Scandinavia Boomerang allows for information disclosure by exposing sensitive credential files via static HTTP. This flaw affects all versions prior to 2.4.18.029. An unauthenticated remote attacker can retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot.
Users can upgrade to version 2.4.18.029 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/posts/2026/07/CVE-2026-46458 | [email protected] | AdvisoryBundleRemedy |
| https://icuscandinavia.se/boomerang-quality-assurance-lab/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ICU Scandinavia Boomerang | < 2.4.18.029 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |