Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-56783 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-40159
Vulnerability Data
Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover…
more
credentials and internal endpoint URLs for all configured notification targets by querying GET /api/v1/targets or related endpoints.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Protection of information at rest requires encryption or equivalent safeguards for stored credentials.
Transmission confidentiality and integrity enforcement stops credentials from being sent in plaintext or without protection.
Authenticator management requires secure generation, storage, and distribution of credentials, directly stopping insecure methods.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).
A.8.24's purpose, guidance (b,c), and key management mandate proper cryptography (algorithms, strength, protection of credentials in storage/transmission) per classification, which stops exploitation of insufficiently-protected credentials; remainder is bounded (e.g. non-cryptographic protections like hashing-only or non-crypto obfuscation per CWE-522 details).
A.8.5 mandates MFA, alternative strong methods, no cleartext transmission/storage of passwords, session termination, brute-force protection and secure log-on procedures that directly stop interception/retrieval of credentials even when they exist, leaving only a bounded remainder (e.g. non-password credentials or post-authentication storage outside log-on flows)
Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.