Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-25729DeepAudit Affected by User Enumeration via Broken Access Control

Low 2.1

In plain English

A low-severity incorrect authorization in DeepAudit from lintsinghua. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DeepAudit is a multi-agent system for code vulnerability discovery. In 3.0.4 and earlier, there is an improper access control vulnerability in the /api/v1/users/ endpoint allows any authenticated user to enumerate all users in the system and retrieve sensitive information including email addresses, phone numbers, full names, and role information.

Affected products (as reported)

Vendor	Product	Versions
lintsinghua	DeepAudit	<= 3.0.4

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/lintsinghua/DeepAudit/security/advisories/GHSA-vmmm-48w2-q56q x_refsource_CONFIRM
https://github.com/lintsinghua/DeepAudit/commit/b2a3b26579d3fdbab5236ae12ed67ae2313175fd x_refsource_MISC