{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wade Sparks"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Yuffie,\n\nUpon further investigation, the VulnCheck CNA determined that these\nvulnerabilities were not suitable for CVE assignment. The\nvulnerabilities exist within a SaaS product and are mitigated at the\nCSP-level which in this case, would be the vendor, EQS Group. Rather than\ncontribute unactionable CVE records, the VulnCheck CNA used its\ndiscretionary prowess to move forward with rejecting these records. This\npolicy aligns with a 2022 blog from MITRE\n\u003chttps://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID\u003e.\nIt\nshould be noted that the vendor informed us that they have published\nadvisories for the respective vulnerabilities in their \"Trust Center\"\ncustomer portal.\n\nThese actions should not be a deterrent for you to pursue CVE assignment\nthrough MITRE or another research CNA.\n\nBest regards,\n\n\u003chttps://www.vulncheck.com/\u003e\n\nWade Sparks III\nVulnCheck\nSenior Vulnerability Analyst\n\n\nOn Tue, Jan 20, 2026 at 12:13\u202fPM Yuffie Kisaragi \u003c\nyuffie.kisaragi () atomicmail io\u003e wrote:\n\n\n\nDear Art,\n\nThank you for sharing your detailed evaluation and for pointing out the\nrelevant sections of the CNA Rules.\n\nYour argument is well reasoned, particularly with respect to the current\nguidance on SaaS and exclusively hosted services.\n\nI have forwarded your evaluation to the CNA for further consideration. It\nwill also be important to understand the vendor\u2019s perspective in light of\nthe points you raised, especially regarding the applicability of the\n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\nWe look forward to receive transparent feedback from the CNA and/or the\nvendor.\n\nTo date, the vendor has remained silent with regard to informing their\nusers about the reported issues. As far as we can determine, no public\nadvisory or user-facing communication has been issued via their\nvulnerability reporting channel (\nhttps://www.eqs.com/report-a-vulnerability/) or elsewhere.\n\nBest regards,\n\nYuffie\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003czmanion () protonmail com\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking,\ndespite being real, independently discovered, responsibly disclosed, and\nacknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software.\nFor a period of time, there was a restriction that only the provider could\nmake or request such an assignment. But the current CVE rules remove this\nrestriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud,\non-premises, artificial intelligence, machine learning) as the sole basis\nfor determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411\nand CVE-2025-34412 published and identify them as affecting an\n\"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag\nwhen all known Products listed in the CVE Record exist only as fully hosted\nservices. If the Vulnerability affects both hosted services and on-premises\nProducts, then this tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n- Art\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/21"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        },
        {
          "url": "https://www.eqs.com/report-a-vulnerability/"
        },
        {
          "url": "https://www.vulncheck.com/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0229",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/21",
            "automated": true,
            "contentSha256": "129a3df9c6db4589d4f36748522adb23150a18cc4a4a985706b7c7951e66992c",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-21T16:29:03Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0229"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-08T07:57:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0229"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}