CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. JohnDoe@example.com would become /members/johndoeexample-com and Jo.test@example.com would become /members/jo-testexample-com. The members list is available to everyone and (in a default configuration) often without authentication. It is therefore trivial to collect a list of email addresses.

• CWE-200

• https://www.buddyboss.com/resources/buddyboss-platform-releases/Release Notes, Vendor Advisory
• https://www.cygenta.co.uk/post/buddybossMitigation, Third Party Advisory
• https://www.buddyboss.com/resources/buddyboss-platform-releases/Release Notes, Vendor Advisory
• https://www.cygenta.co.uk/post/buddybossMitigation, Third Party Advisory

Published

Jan 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44682An issue (6 of 6) was discovered in Veritas Enterprise Vault…9.8
• CVE-2021-44683The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoo…8.2
• CVE-2021-44684naholyr github-todos 3.1.0 is vulnerable to command injectio…9.8
• CVE-2021-44685Git-it through 4.4.0 allows OS command injection at the Bran…9.8
• CVE-2021-44686calibre before 5.32.0 contains a regular expression that is …7.5
• CVE-2021-4469Denver SHO-110 IP cameras expose a secondary HTTP service on…8.7
• CVE-2021-44693Affected devices don't process correctly certain special cra…4.9
• CVE-2021-44694Affected devices don't process correctly certain special cra…5.5
• CVE-2021-44695Affected devices don't process correctly certain special cra…4.9
• CVE-2021-44696Adobe Prelude version 22.1.1 (and earlier) is affected by an…5.5
• CVE-2021-44697Adobe Audition versions 14.4 (and earlier), and 22.0 (and ea…3.3
• CVE-2021-44698Adobe Audition versions 14.4 (and earlier), and 22.0 (and ea…3.3