CVE-2026-31381: Gainsight Assist plugin information disclosure
Published Mar 20, 2026
·Updated
An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.
Affected Software
2 affected components
Gainsight Gainsight Assist plugin
Gainsight Assist
Event History
Mar 20, 2026
CVE Published
via MITRE·01:02 PM
Data Sourced
via MITRE·01:02 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-31381?
CVE-2026-31381 is considered a medium severity vulnerability due to the potential exposure of personally identifiable information.
2
How do I fix CVE-2026-31381?
To fix CVE-2026-31381, update the Gainsight Assist plugin to the latest version provided by Gainsight that addresses this vulnerability.
3
What type of information is disclosed in CVE-2026-31381?
CVE-2026-31381 allows attackers to extract user email addresses that are exposed in base64 encoding.
4
Who is affected by CVE-2026-31381?
Anyone using the Gainsight Assist plugin is potentially affected by CVE-2026-31381.
5
What is the attack vector for CVE-2026-31381?
The attack vector for CVE-2026-31381 involves manipulation of the state parameter in the OAuth callback URL.