CVE-2026-68541 · Other
NO FIX YET · SEE WHAT TO DO
PolicyPress, a compliance policy management tool, hides sensitive content with CSS-only redaction and ships insecure starter workflow defaults. Anyone who can load the page or its underlying data can read content that was meant to be redacted.
first public Jul 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running PolicyPress before version 1.4.1 that rely on CSS-based redaction to hide sensitive policy content. The sources do not describe the exact deployment or access conditions, so teams not using PolicyPress can skip this.
Not affected if version-1.4.1-or-later
Who cares policypress, self-hosted
1.4.1 are affected1.4.1 or laterPolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive content is disclosed via CSS-only web redaction and insecure starter workflow defaults. This issue has been patched in version 1.4.1.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.