VULNARCHIVE

GCVE-1988-2026-0197

Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Description (en)

Hi,

the vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, 
responsibly disclosed, and acknowledged by the vendor.
CVE IDs *can* be assigned for SaaS or similarly "cloud only" software.  For a period of time, there was a restriction 
that only the provider could make or request such an assignment.  But the current CVE rules remove this restriction:

4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises, artificial intelligence, machine 
learning) as the sole basis for determining assignment.

It would have been acceptable (even preferred) to leave CVE-2025-34411 and CVE-2025-34412 published and identify them 
as affecting an "exclusively-hosted-service:"

5.1.11.1 (A CVE Record) MUST use the “exclusively-hosted-service” tag when all known Products listed in the CVE Record 
exist only as fully hosted services. If the Vulnerability affects both hosted services and on-premises Products, then 
this tag MUST NOT be used.

Rules: https://www.cve.org/resourcessupport/allresources/cnarules

Regards,

 - Art


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Art Manion via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, \nresponsibly disclosed, and acknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software.  For a period of time, there was a restriction \nthat only the provider could make or request such an assignment.  But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises, artificial intelligence, machine \nlearning) as the sole basis for determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and CVE-2025-34412 published and identify them \nas affecting an \"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the “exclusively-hosted-service” tag when all known Products listed in the CVE Record \nexist only as fully hosted services. If the Vulnerability affects both hosted services and on-premises Products, then \nthis tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n - Art\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/17"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0197",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/17",
            "automated": true,
            "contentSha256": "d187d28957b37a8564bdb303fce20e7735192773826c8c243907db2920484f09",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T18:26:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0197"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}