CVE-2026-22237
Published: 14 January 2026
Description
The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability…
more
could allow the attacker to cause damage to the targeted platform by abusing internal functionality.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires organizations to review, approve, and manage publicly accessible content to prevent exposure of sensitive internal API documentation.
Provides protections for information accessible from public networks, directly addressing risks from exposed sensitive API documentation.
Monitors and controls communications at system boundaries to block exploitation of internal APIs via crafted HTTP requests informed by the exposed documentation.
Security SummaryAI
CVE-2026-22237 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) published on 2026-01-14, affecting BLUVOYIX. It arises from the exposure of sensitive internal API documentation (CWE-200), which reveals details about internal APIs that should not be publicly accessible.
An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity by sending specially crafted HTTP requests to the APIs exposed through the documentation. Successful exploitation enables the attacker to abuse internal functionality, resulting in high-impact damage to the targeted platform across confidentiality, integrity, and availability.
Mitigation guidance is available in the vendor advisory at https://blusparkglobal.com/bluvoyix/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability exposes sensitive internal API documentation, allowing unauthenticated remote attackers to send crafted HTTP requests to abuse public-facing APIs, directly enabling T1190: Exploit Public-Facing Application.