CVE-2020-36926 SmarterTools SmarterTrack 7922 -Information Disclosure
Attackers can retrieve agent names and IDs via the Chat Management search form, exposing sensitive user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36926?
CVE-2020-36926 is a medium-severity vulnerability in SmarterTools SmarterTrack, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique identifiers.
Weakness: CWE-497
Which versions are affected by CVE-2020-36926?
It affects 1 product.
Products include Smartertools Smartertrack.
How do I fix CVE-2020-36926?
No fix has been published for CVE-2020-36926 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36926 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36926 exists.
Other vulnerabilities in SmarterTools SmarterTrack
- CVE-2022-24387 File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
- CVE-2022-24384 Reflective XSS on SmarterTrack v100.0.8019.14010
- CVE-2022-24386 Stored XSS in SmarterTrack v100.0.8019.14010
- CVE-2022-24385 Information disclosure via direct object access on SmarterTrack v100.0.8019.14010
- CVE-2009-4994 Cross-site scripting in n/a
Sources
Also known as GHSA-rg7x-vp5v-875q.