CVE-2026-32736 Hytale Modding Wiki has Insecure Direct Object Reference / GDPR PII Exposure
Authenticated users can access mod authors' personal information, including names and emails, via insecure direct object references.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32736?
CVE-2026-32736 is a medium-severity vulnerability in HytaleModding wiki, published on 18 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. An Insecure Direct Object Reference (IDOR) vulnerability in versions of the wiki prior to 1.0.0 exposes mod authors' personal information - including full names and email addresses - to any authenticated user who visits a mod page. Any user who creates an account can access sensitive author details by simply navigating to a mod's page via its slug. Version 1.0.0 fixes the issue.
Weakness: CWE-862
Which versions are affected by CVE-2026-32736?
It affects 1 product.
Products include Hytalemodding Wiki.
How do I fix CVE-2026-32736?
No fix has been published for CVE-2026-32736 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-32736 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32736 exists.
Sources
Also known as GHSA-xvq7-wwhx-x2fh.