CVE-2026-90989 — Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints

CVE-2026-90989

Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints PUBLISHED

Description (CNA)

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.

Affected (CNA)

Vendor / product	Versions
Unknown / Tainacan	affected 0 before 1.4.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0b78000b-99ee-4cee-a7e9-369fc8c98093/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.