CVE-2026-68541

CVSS 5.2 (medium) · published 2026-11-13

PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive content is disclosed via CSS-only web redaction and insecure starter workflow defaults. This issue has been patched in version 1.4.1.

Weakness: CWE-200, CWE-390

Source: NVD CVE-2026-68541

References

• https://github.com/sc2in/PolicyPress/commit/131de241014c17c30130d83151da840d005d55d8
• https://github.com/sc2in/PolicyPress/releases/tag/v1.4.1
• https://github.com/sc2in/PolicyPress/security/advisories/GHSA-j557-r6p7-8r3m

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.