CVE-2026-36719: AgentChat v2.3.0 Unauthenticated Information Disclosure – Password Hash Leak

Technical summary

CVE-2026-36719 is an unauthenticated information disclosure vulnerability affecting the /api/v1/user/info endpoint in AgentChat v2.3.0. The endpoint fails to enforce proper access controls, allowing attackers to enumerate user IDs and retrieve associated sensitive data including SHA256 password hashes without authentication. This is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The attack surface is network-accessible, requires no user interaction, and has low complexity—an attacker needs only to craft successive API requests with incrementing or guessed user IDs.

Business impact

Unauthorized disclosure of password hashes and user metadata creates multiple downstream risks. While SHA256 hashes cannot be directly reversed, they are subject to offline dictionary and rainbow-table attacks, especially for weak passwords. Compromised email addresses and account identifiers enable targeted social engineering, credential stuffing, and account takeover attempts. Organizations running AgentChat v2.3.0 face potential data breach notification obligations and reputational damage if user information is exfiltrated at scale. The lack of authentication bypass also indicates missing security controls that may affect other endpoints.

Affected systems

AgentChat v2.3.0 is confirmed vulnerable. Organizations must inventory all instances of this version in production and development environments. The advisory does not specify whether earlier versions (1.x) or later versions (2.4.0+) are affected; verification against the vendor advisory is required to determine the full scope of vulnerable releases.

Exploitability

This vulnerability poses a practical, near-term exploitation risk. The attack requires no authentication, no special tools beyond basic HTTP clients, and can be fully automated. An attacker with network access to the AgentChat deployment can begin enumerating users immediately. The CVSS 3.1 score of 7.5 (HIGH) reflects the ease of exploitation and high confidentiality impact, though integrity and availability are not compromised. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, but that status may change.

Remediation

Immediately upgrade AgentChat to a patched version beyond 2.3.0. Verify patch availability and version compatibility with your deployment before upgrading. As a temporary mitigation pending patching, restrict network access to the /api/v1/user/info endpoint to authenticated users only or place it behind a Web Application Firewall rule that requires valid authentication tokens. Review and revoke any password hashes that may have been exposed during the window of vulnerability.

Patch guidance

Contact your AgentChat vendor or check their security advisory portal for patched release versions. Upgrade should be tested in a staging environment first to confirm compatibility with dependent applications. Verify that the /api/v1/user/info endpoint enforces authentication checks in the patched version before deploying to production. Document the upgrade date and any interim access restrictions applied.

Detection guidance

Monitor access logs for the /api/v1/user/info endpoint, particularly unauthenticated requests or high volumes of requests with varying user ID parameters. Implement alerting for any unauthenticated hits to this endpoint. Review Web Access Logs from the publication date (2026-06-09) backward to identify potential reconnaissance activity. Look for sequential or range-based user ID queries that suggest enumeration attempts. If logs are available, prioritize analysis of any exfiltrated data and cross-reference against your user base to determine exposure scope.

Why prioritize this

This vulnerability merits immediate action due to the combination of high exploitability (no authentication required, network-accessible) and direct confidentiality impact (password hashes and user PII exposure). The lack of current KEV listing does not diminish urgency—exploitation can occur silently and at scale. Organizations must treat patching or mitigation as a priority-one security task.

Risk score, explained

CVSS v3.1 score of 7.5 reflects: (1) network-accessible attack vector with no authentication required; (2) low attack complexity; (3) high confidentiality impact (exposure of sensitive user data); (4) no integrity or availability impact. The score aligns with a HIGH severity rating appropriate for a data disclosure flaw in a user-facing API endpoint. Organizations with strict confidentiality requirements or sensitive user bases should treat this as critical.

Frequently asked questions