AIKIDO-2026-10139
waterhole/core is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
21
Low Risk
This Affects:
waterhole/coreTL;DR
Affected versions of this package exposed sensitive user information through a JSON:API endpoint due to insufficient access control and inadequate handling of deleted resources. An attacker could exploit this by querying the API to enumerate or retrieve data from soft-deleted posts or restricted records before masking and locking were enforced. By abusing predictable identifiers or filters, unauthorized users could access confidential fields that should have been hidden or protected by proper authorization checks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
waterhole/core is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.1.0 - 0.5.0.
How to fix this
Upgrade the waterhole/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant