{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuffie Kisaragi via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dear Art,\n\n\n\n\nThank you for sharing your detailed evaluation and for pointing out the relevant\nsections of the CNA Rules.\n\n\n\n\nYour argument is well reasoned, particularly with respect to the current\nguidance on SaaS and exclusively hosted services.\n\n\n\n\nI have forwarded your evaluation to the CNA for further consideration. It will\nalso be important to understand the vendor\u2019s perspective in light of the points\nyou raised, especially regarding the applicability of the\n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\n\n\nWe look forward to receive transparent\u00a0feedback from the CNA and/or the vendor.\n\n\nTo date, the vendor has remained silent with regard to informing their users\nabout the reported issues. As far as we can determine, no public advisory or\nuser-facing communication has been issued via their vulnerability reporting\nchannel () or elsewhere.\n\n\nBest regards,\n\n\nYuffie\n\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003c\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking,\ndespite being real, independently discovered, responsibly disclosed, and\nacknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software. For a\nperiod of time, there was a restriction that only the provider could make or\nrequest such an assignment. But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises,\nartificial intelligence, machine learning) as the sole basis for determining\nassignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and\nCVE-2025-34412 published and identify them as affecting an\n\"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag when all\nknown Products listed in the CVE Record exist only as fully hosted services.\nIf the Vulnerability affects both hosted services and on-premises Products,\nthen this tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n- Art\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/26"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/26"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0213",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/26",
            "automated": true,
            "contentSha256": "16fb8f39abc59017249ab13d2d1e6c8331ea6508a7c71d74660b4fc553dabf06",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/26",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-20T17:13:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0213"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0213"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}