CVE-2021-21246

CVE-2021-21246 is a sensitive data leak vulnerability affecting OneDev versions prior to 4.0.3, an all-in-one DevOps platform. An unauthenticated attacker can retrieve arbitrary user details, including access tokens, via an unauthenticated REST endpoint. This vulnerability carries a CVSS score of 7.5 (High) due to its network-based attack vector, low complexity, and high impact on confidentiality, potentially leading to impersonation of any user, including administrators. While there is no evidence of active exploitation or Metasploit modules, a Nuclei template exists, and there is minimal community discussion or media coverage.