CVE-2026-122154: purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure
A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
purocean Yank Noteto a version that resolves this vulnerability.Fixed in 3.93.1Patch 59f85d48f17a70a402ad59dcecacdbec20f954df
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerable Settings Endpoint can be attacked remotely, with no privileges or user interaction required. A public exploit is available, which increases the likelihood of attempted exploitation.
Which deployments are affected?
purocean Yank Note version 3.93.0 is identified as affected. The available data does not state whether the vulnerable endpoint is enabled or exposed in default deployments.
What is disclosed by the vulnerable endpoint?
The config.getAll function returns a key that should not be included in the Settings Endpoint response. The patch removes that key from the response.
What should teams do to remediate the issue?
Upgrade the affected component to purocean Yank Note 3.93.1. The remediation is associated with commit 59f85d48f17a70a402ad59dcecacdbec20f954df.