In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security. The endpoint accepts a bearer token and, without enforcing proper authorization, returns detailed information about administrator accounts. Because the API lacks access-control checks, any client possessing a valid token can retrieve privileged data, exposing sensitive credentials and compromising confidentiality. The issue falls under CWE-284 (Improper Access Control) and CWE-863 (Improper Authentication).

The issue is present in Blog.Core written by anjoy8, d17. No specific release version is listed, but the CPE string points to version 8, which does not provide this API. Therefore, the risk applies to any deployment of Blog.Core that includes the vulnerable GetInfoByToken endpoint and does not enforce proper access controls.

With a CVSS score of 4.3 the problem is of medium severity and an EPSS score of less than 1% indicates only a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers must already possess a valid token; if they do, a single call to the endpoint exposes protected credentials. Because the flaw is a token‑based authorization issue, it may lead to further privilege escalation if those credentials are reused.