Compliance Policy Management Tool Vulnerability in PolicyPress by SC2 Innovations
CVE-2026-68541

5.2MEDIUM

Key Information:

Vendor

Sc2in

Status
Policypress
Vendor
CVE Published:
13 November 2026

What is CVE-2026-68541?

PolicyPress, a compliance policy management tool designed for small and mid-size teams, previously allowed for the unintentional disclosure of sensitive content through CSS-only redaction techniques and insecure default configurations. This vulnerability has been addressed in version 1.4.1, ensuring that sensitive information is now better protected. Users are advised to update to this version to mitigate any potential risks associated with the exposure of sensitive data.

Affected Version(s)

PolicyPress < 1.4.1

References

https://github.com/sc2in/PolicyPress/security/advisories/...
x_refsource_CONFIRM
https://github.com/sc2in/PolicyPress/commit/131de241014c1...
x_refsource_MISC
https://github.com/sc2in/PolicyPress/releases/tag/v1.4.1
x_refsource_MISC

CVSS V4

Score:
5.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.