CVE-2026-7166 Multiple vulnerabilities in the Assassin game by Gaudire
Unauthenticated attackers can access sensitive user data, including emails, phone numbers, and information about minors, via the game's API and local database.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7166?
CVE-2026-7166 is a critical vulnerability in Gaudire Assassin game, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and phone number data from the ‘email’ and ‘telefon’ fields. This vulnerability is also present in the local database, as it contains accessible sensitive information such as data on minors and municipal users. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain access to sensitive information and data.
Weakness: CWE-200
Which versions are affected by CVE-2026-7166?
How do I fix CVE-2026-7166?
No fix has been published for CVE-2026-7166 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-7166 being exploited?
There is no known exploitation of CVE-2026-7166 in the wild and no public exploit code.
Sources
Also known as GHSA-qvr5-4jwr-6hcv.