Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-102628

Cadmos LTI exposure of sensitive information via debug mode

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eummena Cadmos LTI

Default version status: unknown

  • 0 to < 2026-09-02affected
  • 2026-09-02unaffected

References