CVE-2021-34369: portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to o...

Security readout for executives and security teams

This CVE describes a possible information exposure issue in Accela Civic Platform where changing a contact sequence value could return sensitive contact details. The vendor disputed applicability, saying authenticated users were authorized to access the queried information. Severity, scoring, and confirmed impact are not provided. Potential exposure is limited to organizations running Accela Civic Platform where the referenced contact-detail endpoint is reachable. Evidence is incomplete because the affected-product metadata is marked n/a and the vendor states the queried information is authorized for authenticated application users. Treat this as a targeted validation item, not an emergency. Prioritize if Accela Civic Platform stores sensitive citizen, permit, licensing, or contact data and is accessible to broad user groups or external authenticated users. Mitigation focus: Check Accela guidance or support statements for applicability to your deployment.; Review whether the referenced endpoint exists and is exposed in your environment.; Limit access to Accela administrative and contact-detail functions to authorized users..

Prepared

Jun 2, 2026, 19:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.