CVE-2026-46458

UNKNOWN 0.0

Credential exposure in ICU Scandinavia Boomerang

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This issue has been fixed in version 2.4.18.029

CWE	CWE-522
Vendor	icu scandinavia
Product	boomerang
Published	Jul 15, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for icu scandinavia boomerang

Be the first to know when new unknown vulnerabilities affecting icu scandinavia boomerang are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

ICU Scandinavia / Boomerang

0 < 2.4.18.029

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/07/CVE-2026-46458 icuscandinavia.se: https://icuscandinavia.se/boomerang-quality-assurance-lab/

Credits

Marek Figielski (vanilla.pl)