Heptabase, developed by Hepta Platforms, contains an exposed dangerous method that can be invoked by unauthenticated remote actors. By tricking a user into loading a malicious web page within the application, the attacker can gain direct access to the victim’s camera and microphone, thereby violating privacy and enabling covert surveillance. The weakness is classified as CWE-749, highlighting the risk of exposing dangerous functionality.

All versions of Heptabase released by Hepta Platforms prior to version 1.90.2 are vulnerable. The vendor recommends updating to version 1.90.2 or later to remedy the exposed method. No further version granularity is available from the vendor.

The CVSS score of 6.9 signifies moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a social‑engineering step: an attacker must persuade a user to load a malicious page inside Heptabase, after which the exposed method can access camera and microphone. Although the attack is remote and user‑dependent, the potential for privacy violation remains significant.