Vulnerability · Published Oct 1, 2026 · Assigned by cisa-cg

CVE-2026-102628Cadmos LTI exposure of sensitive information via debug mode

Critical 9.3

In plain English

A critical-severity security flaw in Cadmos LTI from Eummena. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

Affected products (as reported)

Vendor	Product	Versions
Eummena	Cadmos LTI	0 – before 2026-09-02

Weakness: CWE-215, CWE-489 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References

url third-party-advisory
url vdb-entry
url