CVE-2026-30924

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30924", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T16:40:05.884Z", "datePublished": "2026-03-19T20:45:43.039Z", "dateUpdated": "2026-03-20T19:46:41.711Z"}, "containers": {"cna": {"title": "qui CORS Misconfiguration: Arbitrary Origins Trusted", "problemTypes": [{"descriptions": [{"cweId": "CWE-942", "lang": "en", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/autobrr/qui/security/advisories/GHSA-h8vw-ph9r-xpch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/autobrr/qui/security/advisories/GHSA-h8vw-ph9r-xpch"}, {"name": "https://github.com/autobrr/qui/commit/424f7a0de089dce881e8bbecd220163a78e0295f", "tags": ["x_refsource_MISC"], "url": "https://github.com/autobrr/qui/commit/424f7a0de089dce881e8bbecd220163a78e0295f"}], "affected": [{"vendor": "autobrr", "product": "qui", "versions": [{"version": "<= 1.14.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T20:45:43.039Z"}, "descriptions": [{"lang": "en", "value": "qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a logged-in user. An attacker can exploit this by tricking a victim into loading a malicious webpage, which silently interacts with the application using the victim's session and potentially exfiltrating sensitive data such as API keys and account credentials, or even achieving full system compromise through the built-in External Programs manager. Exploitation requires that the victim access the application via a non-localhost hostname and load an attacker-controlled webpage, making highly targeted social-engineering attacks the most likely real-world scenario. This issue was not fixed at the time of publication."}], "source": {"advisory": "GHSA-h8vw-ph9r-xpch", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T19:46:07.320056Z", "id": "CVE-2026-30924", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T19:46:41.711Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T19:46:07.320056Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T19:46:29.038Z"}}], "cna": {"title": "qui CORS Misconfiguration: Arbitrary Origins Trusted", "source": {"advisory": "GHSA-h8vw-ph9r-xpch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "autobrr", "product": "qui", "versions": [{"status": "affected", "version": "<= 1.14.1"}]}], "references": [{"url": "https://github.com/autobrr/qui/security/advisories/GHSA-h8vw-ph9r-xpch", "name": "https://github.com/autobrr/qui/security/advisories/GHSA-h8vw-ph9r-xpch", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/autobrr/qui/commit/424f7a0de089dce881e8bbecd220163a78e0295f", "name": "https://github.com/autobrr/qui/commit/424f7a0de089dce881e8bbecd220163a78e0295f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a logged-in user. An attacker can exploit this by tricking a victim into loading a malicious webpage, which silently interacts with the application using the victim's session and potentially exfiltrating sensitive data such as API keys and account credentials, or even achieving full system compromise through the built-in External Programs manager. Exploitation requires that the victim access the application via a non-localhost hostname and load an attacker-controlled webpage, making highly targeted social-engineering attacks the most likely real-world scenario. This issue was not fixed at the time of publication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T20:45:43.039Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30924", "state": "PUBLISHED", "dateUpdated": "2026-03-20T19:46:41.711Z", "dateReserved": "2026-03-07T16:40:05.884Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-19T20:45:43.039Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "qui", "vendor": "autobrr", "versions": [{"status": "affected", "version": "<= 1.14.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getqui:qui:*:*:*:*:*:docker:*:*", "matchCriteriaId": "D24F98B6-7767-40D1-B443-B638E9852327", "versionEndExcluding": "1.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a logged-in user. An attacker can exploit this by tricking a victim into loading a malicious webpage, which silently interacts with the application using the victim's session and potentially exfiltrating sensitive data such as API keys and account credentials, or even achieving full system compromise through the built-in External Programs manager. Exploitation requires that the victim access the application via a non-localhost hostname and load an attacker-controlled webpage, making highly targeted social-engineering attacks the most likely real-world scenario. This issue was not fixed at the time of publication."}, {"lang": "es", "value": "qui es una interfaz web para gestionar instancias de qBittorrent. Las versiones 1.14.1 e inferiores utilizan una pol\u00edtica CORS permisiva que refleja or\u00edgenes arbitrarios y tambi\u00e9n devuelve Access-Control-Allow-Credentials: true, permitiendo efectivamente que cualquier p\u00e1gina web externa realice solicitudes autenticadas en nombre de un usuario con sesi\u00f3n iniciada. Un atacante puede explotar esto enga\u00f1ando a una v\u00edctima para que cargue una p\u00e1gina web maliciosa, la cual interact\u00faa silenciosamente con la aplicaci\u00f3n utilizando la sesi\u00f3n de la v\u00edctima y potencialmente exfiltrando datos sensibles como claves API y credenciales de cuenta, o incluso logrando un compromiso total del sistema a trav\u00e9s del gestor de Programas Externos incorporado. La explotaci\u00f3n requiere que la v\u00edctima acceda a la aplicaci\u00f3n a trav\u00e9s de un nombre de host que no sea localhost y cargue una p\u00e1gina web controlada por el atacante, lo que convierte los ataques de ingenier\u00eda social altamente dirigidos en el escenario m\u00e1s probable en el mundo real. Este problema no fue solucionado en el momento de la publicaci\u00f3n."}], "id": "CVE-2026-30924", "lastModified": "2026-06-17T10:33:09.543", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30924", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T19:46:07.320056Z", "version": "2.0.3"}}]}, "published": "2026-03-19T21:17:09.943", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/autobrr/qui/commit/424f7a0de089dce881e8bbecd220163a78e0295f"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/autobrr/qui/security/advisories/GHSA-h8vw-ph9r-xpch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-942"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.14.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "qui", "source": "cna", "vendor": "autobrr"}, "product": "qui", "vendor": "autobrr"}], "analysis": {"en": {"generated_at": "2026-04-14T21:50:11.687195+00:00", "value": {"mitigation_remediation": ["Upgrade qui to a version newer than 1.14.1 as soon as an update is available.", "If patching is delayed, limit the web interface to localhost or an isolated internal network and avoid exposing it to external hosts.", "Configure a reverse proxy to reject or block requests that contain Cross\u2011Origin headers for untrusted origins.", "Remove or disable the Allow\u2011Credentials header in any exposed deployment when the policy cannot be fixed.", "Monitor application logs for unexpected cross\u2011origin requests or API activity originating from unfamiliar IP addresses or user agents.", "Apply web application firewall rules to filter or block cross\u2011origin requests that appear malicious when the service is exposed to the internet."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution and data exfiltration"}, "threat_synthesis": {"affected_systems": "The issue targets the autobrr:qui web interface used to manage qBittorrent instances. Versions 1.14.1 and all previous releases are affected. Deployments running these images in Docker containers or other environments that expose the service through a hostname other than localhost are at risk. Users operating the interface from internal networks but still reachable externally are also susceptible if no additional network restrictions are in place.", "description_and_impact": "The vulnerability arises from a permissive CORS policy that reflects any origin while setting the Allow\u2011Credentials header to true. This configuration permits any loaded webpage to issue authenticated requests on behalf of a logged\u2011in user. An attacker can consequently read sensitive data such as API keys and account credentials or trigger the built\u2011in External Programs manager to execute code on the host machine. The flaw aligns with the CWE\u2011942 weakness in handling complex request headers.", "risk_and_exploitability": "The vulnerability has a CVSS score of 9, indicating critical severity. An EPSS rating below 1\u202f% suggests that exploit attempts are uncommon, and the vulnerability has not appeared in the KEV listing. Exploitation depends on social engineering: an attacker must persuade an authenticated user to visit an attacker\u2011controlled webpage. When successful, an adversary can exfiltrate credentials, capture API keys, or elevate privileges through the External Programs manager, representing a high impact if the target system is exposed. The risk remains significant for installations that are publicly reachable or have no isolation measures."}}}}, "created": "2026-03-20T08:56:09.025767+00:00", "updated": "2026-04-15T16:45:09.836899+00:00", "vendors": ["autobrr", "autobrr$PRODUCT$qui"]}