All vulnerabilities
CVE-2026-102628

Cadmos LTI exposure of sensitive information via debug mode

Eummena Cadmos LTI
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026-09-02Fixed versionCVE List
Published1 Oct 2026Updated 11 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

Text from CVE List

Affected versions 2

  • Cadmos LTIaffected: all versions before 2026-09-02CVE List
  • Cadmos LTIunaffected: 2026-09-02CVE List

References 3