CVE-2026-27579

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27579", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T17:40:28.449Z", "datePublished": "2026-02-21T10:22:15.671Z", "dateUpdated": "2026-02-24T18:07:30.160Z"}, "containers": {"cna": {"title": "CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-942", "lang": "en", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-qh5m-p8jh-hx88", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-qh5m-p8jh-hx88"}], "affected": [{"vendor": "karnop", "product": "realtime-collaboration-platform", "versions": [{"version": "<= master", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T10:22:15.671Z"}, "descriptions": [{"lang": "en", "value": "CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication."}], "source": {"advisory": "GHSA-qh5m-p8jh-hx88", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:07:10.486074Z", "id": "CVE-2026-27579", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:07:30.160Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27579", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:07:10.486074Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:07:21.780Z"}}], "cna": {"title": "CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure", "source": {"advisory": "GHSA-qh5m-p8jh-hx88", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "karnop", "product": "realtime-collaboration-platform", "versions": [{"status": "affected", "version": "<= master"}]}], "references": [{"url": "https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-qh5m-p8jh-hx88", "name": "https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-qh5m-p8jh-hx88", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T10:22:15.671Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27579", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:07:30.160Z", "dateReserved": "2026-02-20T17:40:28.449Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-21T10:22:15.671Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "realtime-collaboration-platform", "vendor": "karnop", "versions": [{"status": "affected", "version": "<= master"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication."}, {"lang": "es", "value": "CollabPlatform es una plataforma de colaboraci\u00f3n de documentos en tiempo real, full-stack. En todas las versiones de CollabPlatform, el proyecto Appwrite utilizado por la aplicaci\u00f3n est\u00e1 mal configurado para permitir or\u00edgenes arbitrarios en las respuestas CORS, al mismo tiempo que permite solicitudes con credenciales. Un dominio controlado por un atacante puede emitir solicitudes autenticadas de origen cruzado y leer informaci\u00f3n sensible de la cuenta de usuario, incluyendo direcci\u00f3n de correo electr\u00f3nico, identificadores de cuenta y estado de MFA. El problema no ten\u00eda una soluci\u00f3n en el momento de la publicaci\u00f3n."}], "id": "CVE-2026-27579", "lastModified": "2026-06-17T10:27:20.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27579", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:07:10.486074Z", "version": "2.0.3"}}]}, "published": "2026-02-21T11:15:57.600", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-qh5m-p8jh-hx88"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-942"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,master]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "realtime-collaboration-platform", "source": "cna", "vendor": "karnop"}, "product": "realtime-collaboration-platform", "vendor": "karnop"}], "analysis": {"en": {"generated_at": "2026-04-18T11:18:44.073350+00:00", "value": {"mitigation_remediation": ["Reconfigure the Appwrite CORS settings to allow only trusted origins and disable the credentials flag for cross\u2011origin requests.", "After correcting the CORS policy, enforce strict origin policies on the CollabPlatform front\u2011end and ensure that only authenticated sessions use credentials.", "Rotate credentials and, if necessary, require users to reset passwords and re\u2011enable MFA to protect against any compromised accounts."], "summary": {"action": "Apply workaround", "impact": "Authenticated Account Data Exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects every instance of CollabPlatform, a full\u2011stack, real\u2011time document collaboration platform provided by karnop. All released versions are impacted because the underlying Appwrite project uses a default CORS configuration that allows any origin. No specific version range is supplied, indicating universal exposure across all product releases.", "description_and_impact": "In all versions of CollabPlatform, the Appwrite project that powers the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. Because of this, an attacker\u2011controlled domain can issue authenticated cross\u2011origin requests and read sensitive user account information, such as email addresses, account identifiers, and MFA status. The flaw is a classic CORS bypass that results in authenticated account data exposure (CWE\u2011346 and CWE\u2011942).", "risk_and_exploitability": "The CVSS score of 7.4 indicates a high likelihood of serious consequences if exploited. However, the EPSS score is listed as less than 1\u202f%, reflecting a low current probability of exploitation, and the vulnerability is not present in CISA's KEV catalog. The attack requires an attacker\u2011controlled domain and a user who is already authenticated to the platform. Once those conditions are met, the attacker can harvest sensitive account data through cross\u2011origin requests, potentially leading to credential compromise or further account\u2011takeover attacks. Therefore, while exploitation currently appears uncommon, the exposed data and lack of a publicly available fix make this a risk that should be mitigated promptly."}}}}, "created": "2026-02-23T14:31:59.618863+00:00", "updated": "2026-04-18T11:30:44.308424+00:00", "vendors": ["karnop", "karnop$PRODUCT$realtime-collaboration-platform"]}