Description (CNA)
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SonarSource / SonarQube | affected 10.2 Community before 25.6 Community; affected 10.2 Commercial before 2025.3 Commercial; affected 2025.1 LTA before 2025.1.3 LTA |
CWE
CWE-669
References
ADP enrichment
No English description supplied.
No references supplied.