{"uuid": "f94a9b27-7dcf-4644-9d20-53bff44c7a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117140433676918715", "content": "\ud83d\udea8\ud83c\uddeb\ud83c\uddf7 iMapper allegedly breached through critical Metabase vulnerability, account data and database access leaked on a cybercrime forum\u2800A forum actor claims to have compromised iMapper, a French web-connected 2D laser measurement platform for building professionals, using a vulnerability identified in the listing as CVE-2026-72898 with a claimed CVSS score of 10.0.\u2800The exposed account dataset reportedly contains 2,463 records and includes:\u2800\u2022 User IDs and usernames\u2022 Password hashes\u2022 Account roles\u2022 Email addresses\u2022 Phone numbers\u2022 Professions\u2022 MFA status and related metadata\u2022 Language preferences\u2022 Stripe customer IDs\u2022 Stripe tax-related identifiers\u2022 Measurement and display configuration fields\u2800The data is being distributed in XLSX format. The listing also claims the compromised environment contains additional database tables and offers credentials that could provide access to those systems.\u2800The claims, exploitation method and authenticity, availability and scope of the allegedly exposed data and database access have not been independently verified.\u2800\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing", "creation_timestamp": "2026-08-22T17:52:49.042082Z"}