{"id":"CVE-2026-41561","published":"2026-10-06T09:17:53.873","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/museder-restoreone/vulnerability/wordpress-museder-restoreone-plugin-2-7-276-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Museder RestoreOne backup software has an unauthenticated sensitive data exposure vulnerability that allows attackers to access protected data without needing any credentials. This is particularly concerning because it affects backup functionality where sensitive information is typically stored.","exploitability":"Exploitation is straightforward with no prerequisites as the vulnerability affects unauthenticated endpoints that expose sensitive data directly to any external party.","blast_radius":"The impact could be significant across all affected versions up to 2.7.276, potentially exposing backup data containing sensitive information to unauthorized parties.","remediation":"Upgrade to version 2.7.277 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfiltration","backup","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:58.829Z"}}