CVE-2026-7686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7686", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-02T16:03:17.517Z", "datePublished": "2026-05-03T07:30:12.937Z", "dateUpdated": "2026-05-04T15:02:41.096Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-03T07:30:12.937Z"}, "title": "eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "eyeo", "product": "Adblock Plus", "versions": [{"version": "4.36.0", "status": "affected"}, {"version": "4.36.1", "status": "affected"}, {"version": "4.36.2", "status": "affected"}], "modules": ["Legacy Premium Activation"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.js of the component Legacy Premium Activation. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Upgrading the affected component is recommended. The vendor provides additional details: \"The affected code path is a legacy Premium activation flow that has been deprecated. eyeo has already migrated to a new user account-based licensing system. The exploit does not grant permanent Premium access. The licensing server issues a short-lived trial license (valid for approximately 24 hours) for any submitted userId. On the next license check, the server validates against a real subscription and the trial expires if no valid subscription is found. The researcher's claim of permanently unlocking all Premium features is therefore incorrect. (...) The old flow has been present for years and has not been weaponized at scale to our knowledge. The risk to eyeo and to users is minimal.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-05-02T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-02T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-02T18:08:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "DRXYJ (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/360856", "name": "VDB-360856 | eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360856/cti", "name": "VDB-360856 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/793551", "name": "Submit #793551 | Eyeo GmbH Adblock Plus 4.36.2 Privilege Escalation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/xryj920/CVE/blob/main/adblock_plus_CVE_report.md", "tags": ["exploit"]}, {"url": "https://adblockplus.org/en/download", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T15:02:15.880067Z", "id": "CVE-2026-7686", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T15:02:41.096Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control", "credits": [{"lang": "en", "type": "reporter", "value": "DRXYJ (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "eyeo", "modules": ["Legacy Premium Activation"], "product": "Adblock Plus", "versions": [{"status": "affected", "version": "4.36.0"}, {"status": "affected", "version": "4.36.1"}, {"status": "affected", "version": "4.36.2"}]}], "timeline": [{"lang": "en", "time": "2026-05-02T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-02T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-02T18:08:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/360856", "name": "VDB-360856 | eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360856/cti", "name": "VDB-360856 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/793551", "name": "Submit #793551 | Eyeo GmbH Adblock Plus 4.36.2 Privilege Escalation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/xryj920/CVE/blob/main/adblock_plus_CVE_report.md", "tags": ["exploit"]}, {"url": "https://adblockplus.org/en/download", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.js of the component Legacy Premium Activation. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Upgrading the affected component is recommended. The vendor provides additional details: \"The affected code path is a legacy Premium activation flow that has been deprecated. eyeo has already migrated to a new user account-based licensing system. The exploit does not grant permanent Premium access. The licensing server issues a short-lived trial license (valid for approximately 24 hours) for any submitted userId. On the next license check, the server validates against a real subscription and the trial expires if no valid subscription is found. The researcher's claim of permanently unlocking all Premium features is therefore incorrect. (...) The old flow has been present for years and has not been weaponized at scale to our knowledge. The risk to eyeo and to users is minimal.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-03T07:30:12.937Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7686", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-04T15:02:15.880067Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-04T15:02:24.657Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-7686", "state": "PUBLISHED", "dateUpdated": "2026-05-03T07:30:12.937Z", "dateReserved": "2026-05-02T16:03:17.517Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-03T07:30:12.937Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Legacy Premium Activation"], "product": "Adblock Plus", "vendor": "eyeo", "versions": [{"status": "affected", "version": "4.36.0"}, {"status": "affected", "version": "4.36.1"}, {"status": "affected", "version": "4.36.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.js of the component Legacy Premium Activation. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Upgrading the affected component is recommended. The vendor provides additional details: \"The affected code path is a legacy Premium activation flow that has been deprecated. eyeo has already migrated to a new user account-based licensing system. The exploit does not grant permanent Premium access. The licensing server issues a short-lived trial license (valid for approximately 24 hours) for any submitted userId. On the next license check, the server validates against a real subscription and the trial expires if no valid subscription is found. The researcher's claim of permanently unlocking all Premium features is therefore incorrect. (...) The old flow has been present for years and has not been weaponized at scale to our knowledge. The risk to eyeo and to users is minimal.\""}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en eyeo Adblock Plus hasta la versi\u00f3n 4.36.2 en Chrome. Afectada por esta vulnerabilidad es la funci\u00f3n postMessage del archivo premium.preload.js del componente Legacy Premium Activation. Realizar una manipulaci\u00f3n resulta en controles de acceso inadecuados. La explotaci\u00f3n remota del ataque es posible. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado. Se recomienda actualizar el componente afectado. El proveedor proporciona detalles adicionales: \u2019La ruta de c\u00f3digo afectada es un flujo de activaci\u00f3n Premium heredado que ha sido desaprobado. eyeo ya ha migrado a un nuevo sistema de licencias basado en cuentas de usuario. El exploit no otorga acceso Premium permanente. El servidor de licencias emite una licencia de prueba de corta duraci\u00f3n (v\u00e1lida por aproximadamente 24 horas) para cualquier userId enviado. En la siguiente verificaci\u00f3n de licencia, el servidor valida contra una suscripci\u00f3n real y la prueba expira si no se encuentra una suscripci\u00f3n v\u00e1lida. La afirmaci\u00f3n del investigador de desbloquear permanentemente todas las funciones Premium es, por lo tanto, incorrecta. (...) El flujo antiguo ha estado presente durante a\u00f1os y no ha sido utilizado como arma a gran escala, que sepamos. El riesgo para eyeo y para los usuarios es m\u00ednimo.\u2019"}], "id": "CVE-2026-7686", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7686", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T15:02:15.880067Z", "version": "2.0.3"}}]}, "published": "2026-05-03T08:16:01.073", "references": [{"source": "cna@vuldb.com", "url": "https://adblockplus.org/en/download"}, {"source": "cna@vuldb.com", "url": "https://github.com/xryj920/CVE/blob/main/adblock_plus_CVE_report.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/793551"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360856"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360856/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.36.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.36.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.36.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Adblock Plus", "source": "cna", "vendor": "eyeo"}, "product": "adblock_plus", "vendor": "eyeo"}], "created": "2026-05-03T09:30:16.064601+00:00", "updated": "2026-05-04T16:06:32.819062+00:00", "vendors": ["eyeo", "eyeo$PRODUCT$adblock_plus"]}