CVE-2023-37749: Medium severity HubSpot HubSpot vulnerability

Published Oct 27, 2025

Updated

Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization.

Affected Software

1 affected component

HubSpot HubSpot

Event History

Oct 27, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-37749?

CVE-2023-37749 is considered a critical vulnerability due to its potential for unauthorized data exposure.

How do I fix CVE-2023-37749?

To fix CVE-2023-37749, implement proper access controls and ensure authentication is required for the affected REST API endpoint.

Who is affected by CVE-2023-37749?

CVE-2023-37749 affects users of HubSpot version v1.29441 and earlier, where the REST API endpoint lacks sufficient access controls.

What data can be exposed due to CVE-2023-37749?

CVE-2023-37749 allows unauthenticated attackers to view users' sensitive data, which can include personal information stored in HubSpot.

Is there a patch available for CVE-2023-37749?

Yes, HubSpot has released updates that address CVE-2023-37749, and users are encouraged to upgrade to the latest version.