What is CVE-2026-102628?

CVE-2026-102628 is a critical-severity vulnerability in Eummena Cadmos Lti, classified under Insertion of Sensitive Information Into Debugging Code. CVSS score: 9.3/10. Published 2026-10-01.

How severe is CVE-2026-102628?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Vulnerability in Eummena Cadmos Lti

CVE-2026-102628

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

Published 2026-10-01 · last modified 2026-10-01.

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Eummena Cadmos Lti

Weakness classification (CWE)

References

9119a7d8-5eab-497f-8521-727c672e3725 (third-party-advisory)
9119a7d8-5eab-497f-8521-727c672e3725 (vdb-entry)

Frequently asked questions

What is CVE-2026-102628?: CVE-2026-102628 is a critical-severity vulnerability in Eummena Cadmos Lti, classified under Insertion of Sensitive Information Into Debugging Code. CVSS score: 9.3/10. Published 2026-10-01.
How severe is CVE-2026-102628?: Critical severity. CVSS v3 base score is 9.3 out of 10.