CVE-2026-8152

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8152", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2026-05-08T08:12:13.325Z", "datePublished": "2026-07-22T12:21:28.977Z", "dateUpdated": "2026-07-22T18:55:07.732Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-07-22T12:21:28.977Z"}, "title": "Unblu Spark Open Redirect leading to DOM-Based XSS", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "CAPEC-588 \u2014 DOM-Based XSS"}]}], "affected": [{"vendor": "Unblu inc.", "product": "Unblu Spark", "platforms": ["On-premises", "Cloud"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.36.1", "versionType": "semver"}, {"status": "unaffected", "version": "8.36.1-hotfix.0", "versionType": "semver"}, {"status": "unaffected", "version": "8.37.0", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div>Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.</div><br><div>When Unblu Spark is deployed with <code>com.unblu.identifier.siteEmbeddedSetup=true</code>, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.</div></div><p><br></p>"}]}], "references": [{"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001", "name": "Unblu Security Advisories", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "On-premises deployment (same site)"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Cloud deployment"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "If you cannot upgrade immediately, either of the following measures prevents exploitation:\n\n * Enable the built-in Content Security Policy by setting\u00a0com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note:\u00a0this protection is only effective on Unblu Spark 7.56.2 or later\u00a0in the 7.x series and 8.19.1 or later\u00a0in the 8.x series, where\u00a0unsafe-inline\u00a0was removed from the script source policy. Earlier versions ship a CSP that still permits\u00a0unsafe-inline\u00a0and are not protected by this workaround.\n * Configure a WAF rule to block requests that carry a malicious payload in the\u00a0redirectOnFailure\u00a0parameter (in particular, values containing a\u00a0javascript:\u00a0scheme or obfuscated variants such as\u00a0java%0ascript:).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>If you cannot upgrade immediately, either of the following measures prevents exploitation:</div><div><ul><li>Enable the built-in Content Security Policy by setting&nbsp;<code>com.unblu.contentsecuritypolicy.mode=on</code>. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. <b>Note:</b>&nbsp;this protection is only effective on Unblu Spark <b>7.56.2 or later</b>&nbsp;in the 7.x series and <b>8.19.1 or later</b>&nbsp;in the 8.x series, where&nbsp;<code>unsafe-inline</code>&nbsp;was removed from the script source policy. Earlier versions ship a CSP that still permits&nbsp;<code>unsafe-inline</code>&nbsp;and are not protected by this workaround.</li><li>Configure a WAF rule to block requests that carry a malicious payload in the&nbsp;<code>redirectOnFailure</code>&nbsp;parameter (in particular, values containing a&nbsp;<code>javascript:</code>&nbsp;scheme or obfuscated variants such as&nbsp;<code>java%0ascript:</code>).</li></ul></div><br><br>"}]}], "solutions": [{"lang": "en", "value": "In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\n\n\nAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.</div><br><div>After upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (<code>document.location.origin</code>).</div><div><br></div><br>"}]}], "credits": [{"lang": "en", "value": "Kenan Karalioglu (chef_shell) via YesWeHack", "type": "finder"}], "source": {"advisory": "UBL-2026-001", "discovery": "EXTERNAL"}, "x_generator": {"engine": "manual"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T18:54:56.321413Z", "id": "CVE-2026-8152", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:55:07.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8152", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:54:56.321413Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:55:03.407Z"}}], "cna": {"title": "Unblu Spark Open Redirect leading to DOM-Based XSS", "source": {"advisory": "UBL-2026-001", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Kenan Karalioglu (chef_shell) via YesWeHack"}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "CAPEC-588 \u2014 DOM-Based XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "On-premises deployment (same site)"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "Cloud deployment"}]}], "affected": [{"vendor": "Unblu inc.", "product": "Unblu Spark", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.36.1"}, {"status": "unaffected", "version": "8.36.1-hotfix.0", "versionType": "semver"}, {"status": "unaffected", "version": "8.37.0", "versionType": "semver"}], "platforms": ["On-premises", "Cloud"], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\n\n\nAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin).", "supportingMedia": [{"type": "text/html", "value": "<div>In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.</div><br><div>After upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (<code>document.location.origin</code>).</div><div><br></div><br>", "base64": false}]}], "references": [{"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001", "name": "Unblu Security Advisories", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "If you cannot upgrade immediately, either of the following measures prevents exploitation:\n\n * Enable the built-in Content Security Policy by setting\u00a0com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note:\u00a0this protection is only effective on Unblu Spark 7.56.2 or later\u00a0in the 7.x series and 8.19.1 or later\u00a0in the 8.x series, where\u00a0unsafe-inline\u00a0was removed from the script source policy. Earlier versions ship a CSP that still permits\u00a0unsafe-inline\u00a0and are not protected by this workaround.\n * Configure a WAF rule to block requests that carry a malicious payload in the\u00a0redirectOnFailure\u00a0parameter (in particular, values containing a\u00a0javascript:\u00a0scheme or obfuscated variants such as\u00a0java%0ascript:).", "supportingMedia": [{"type": "text/html", "value": "<div>If you cannot upgrade immediately, either of the following measures prevents exploitation:</div><div><ul><li>Enable the built-in Content Security Policy by setting&nbsp;<code>com.unblu.contentsecuritypolicy.mode=on</code>. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. <b>Note:</b>&nbsp;this protection is only effective on Unblu Spark <b>7.56.2 or later</b>&nbsp;in the 7.x series and <b>8.19.1 or later</b>&nbsp;in the 8.x series, where&nbsp;<code>unsafe-inline</code>&nbsp;was removed from the script source policy. Earlier versions ship a CSP that still permits&nbsp;<code>unsafe-inline</code>&nbsp;and are not protected by this workaround.</li><li>Configure a WAF rule to block requests that carry a malicious payload in the&nbsp;<code>redirectOnFailure</code>&nbsp;parameter (in particular, values containing a&nbsp;<code>javascript:</code>&nbsp;scheme or obfuscated variants such as&nbsp;<code>java%0ascript:</code>).</li></ul></div><br><br>", "base64": false}]}], "x_generator": {"engine": "manual"}, "descriptions": [{"lang": "en", "value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.", "supportingMedia": [{"type": "text/html", "value": "<div><div>Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.</div><br><div>When Unblu Spark is deployed with <code>com.unblu.identifier.siteEmbeddedSetup=true</code>, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.</div></div><p><br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-07-22T12:21:28.977Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8152", "state": "PUBLISHED", "dateUpdated": "2026-07-22T18:55:07.732Z", "dateReserved": "2026-05-08T08:12:13.325Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2026-07-22T12:21:28.977Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "platforms": ["On-premises", "Cloud"], "product": "Unblu Spark", "vendor": "Unblu inc.", "versions": [{"lessThanOrEqual": "8.36.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "8.36.1-hotfix.0", "versionType": "semver"}, {"status": "unaffected", "version": "8.37.0", "versionType": "semver"}]}], "source": "vulnerability@ncsc.ch"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL."}, {"lang": "es", "value": "Unblu Spark contiene una vulnerabilidad de redirecci\u00f3n abierta que puede escalarse a un ataque de cross-site scripting (XSS) basado en DOM.\n\nCuando Unblu Spark se despliega con com.unblu.identifier.siteEmbeddedSetup=true, se ejecuta en el mismo origen que la aplicaci\u00f3n anfitriona. Cualquier JavaScript inyectado a trav\u00e9s de esta vulnerabilidad, por lo tanto, se ejecuta con acceso total a las cookies, el DOM y las API del mismo origen de la aplicaci\u00f3n anfitriona - un atacante puede alcanzar todos los recursos de la aplicaci\u00f3n anfitriona, no solo los de Unblu. Este radio de impacto expandido es la raz\u00f3n por la que los despliegues locales que utilizan esta configuraci\u00f3n se califican como CR\u00cdTICOS."}], "id": "CVE-2026-8152", "lastModified": "2026-10-24T17:10:00.220", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8152", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T18:54:56.321413Z", "version": "2.0.3"}}]}, "published": "2026-07-22T13:16:38.423", "references": [{"source": "vulnerability@ncsc.ch", "url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-601"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["on-premises", "cloud"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.36.1]"}}, {"platform": ["on-premises", "cloud"], "status": "unaffected", "versions": {"scheme": "semver", "value": "8.36.1-hotfix.0"}}, {"platform": ["on-premises", "cloud"], "status": "unaffected", "versions": {"scheme": "semver", "value": "8.37.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Unblu Spark", "source": "cna", "vendor": "Unblu inc."}, "product": "spark", "vendor": "unblu"}], "created": "2026-07-23T19:00:17.244259+00:00", "updated": "2026-08-04T00:00:09.750079+00:00", "vendors": ["unblu", "unblu$PRODUCT$spark"]}