CVE-2023-37749

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-37754.9A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to CVE-2023-377549.8PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.CVE-2023-377559.8i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning CVE-2023-377569.8I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are abl CVE-2023-377587.5D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi.CVE-2023-377599.8Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to regi CVE-2023-37767.8A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If CVE-2023-377655.5GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at /lib/libgp CVE-2023-377665.5GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_isom_remove_user_data function at /lib/l CVE-2023-377675.5GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at /lib/CVE-2023-377696.5stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.CVE-2023-37777.8A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.