Cloudanix VulnDB

GHSA-9gjv-jvm7-vv2v

Medium · 5.3

Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users

CVSS

5.3

EPSS

—

Published

Apr 9, 2026

CISA due date

—

The record

Users with the **Guest** role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as `GET /api/people/`, `GET /api/places/`, `GET /api/events/`, and all other object list endpoints. **This does not expose objects (people, places, events, …) that are themselves marked private.** Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities