full-disclosure - [FD] Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Open Source and information security mailing list archives

Message-ID: <4760c922-fbf9-30ad-9f15-0cabddc5ae67@atomicmail.io>
Date: Sun, 04 Jan 2026 22:01:57 +0000
From: Yuffie Kisaragi via Fulldisclosure <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
 "security-vulnerability@....com" <security-vulnerability@....com>
Subject: [FD] Multiple Security Misconfigurations and Customer Enumeration
 Exposure in Convercent Whistleblowing Platform (EQS Group)

UPDATE:

Following the publication of these vulnerabilities and the subsequent CVE
assignments, the CVE identifiers have now been revoked.

The vendor (EQS Group) contacted the CVE Program (via a CNA) and disputed the
records, stating that the affected product is an exclusively hosted SaaS
platform with no customer-managed deployment or versioning. Based on this
argument, the CVE Program concluded that CVE assignment is “not a suitable
solution for vulnerability identification” in this case, as customers do not
take direct action to apply fixes.

In other words, because the service is centrally hosted and patched at the
provider’s discretion, the vulnerabilities are no longer considered eligible for
CVE tracking, despite being real, independently discovered, responsibly
disclosed, and acknowledged by the vendor.

The vendor has stated that fixes are being implemented and that private customer
notifications will be issued internally.

While remediation is of course welcome, this outcome highlights a broader issue:
vulnerabilities in SaaS platforms can effectively disappear from public
vulnerability tracking, simply because the deployment model removes user agency,
a model that arguably incentivizes security through obscurity, rather than
transparency.

The technical findings remain valid.

This update is shared purely for accuracy and record-keeping.

On Sun, Jan 4, 2026 at 4:40 PM <yuffie.kisaragi@...micmail.io
[yuffie.kisaragi@...micmail.io]> wrote:
> UPDATE:
> 
> 
> The reported vulnerabilities have now been assigned CVE identifiers:
> CVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411
> [https://www.cve.org/cverecord?id=CVE-2025-34411]
> CVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412
> [https://www.cve.org/cverecord?id=CVE-2025-34412]
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives