Sage DPW Unauthenticated Information Disclosure Vulnerability in Database Monitor

A vulnerability in Sage DPW version 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, which is disabled by default and not available in Sage DPW Cloud. The vulnerability exposes sensitive information such as database hashes and table names. This issue arises only in non-default, on-premise installations where the Database Monitor was manually enabled.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive database information, including user data such as email addresses, password hashes, salts, and metadata.

Remediation

Users can update to Sage DPW version 2025_06_004, where this vulnerability has been fixed.