CVE-2026-7166: Multiple vulnerabilities in the Assassin game by Gaudire

Synopsis

This is a sensitive data exposure vulnerability in the Assassin game by Gaudire. The API lacks access controls, allowing an unauthenticated attacker to reach it over the network with no prior credentials required. Successful exploitation gives the attacker direct read access to email addresses, phone numbers, and records belonging to minors and municipal users stored in the application database. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application's API over the network; the CVSS vector specifies AV:N, meaning the service must be network-accessible.

• AuthenticationNot required

  No credentials are needed; PR:N indicates the API endpoint is reachable and exploitable without any account or session token.

• Victim interactionNot required

  UI:N means the attacker does not need to trick or involve any user; the data is directly accessible without any victim action.

• Attack complexityDetail

  AC:L indicates the exploit is straightforward and condition-free, requiring no special timing, race conditions, or environmental setup.

Blast Radius

• The attacker reads email addresses and phone numbers from the exposed API fields ('email' and 'telefon') for all registered users.
• Records belonging to minors are accessible, exposing personally identifiable information for a legally protected population.
• Municipal user data stored in the local database is readable, potentially exposing government-affiliated contact details and account information.
• Scope impact is high on the system component (SC:H), meaning data from components beyond the directly attacked service is also exposed.