Toonflow CVE-2026-109526

Exploitation requires LOCAL access to a system running the vulnerable Toonflow-app (version 1.1.8 or earlier) AND an existing low-privilege authenticated session (CVSS AV:L, PR:L) - remote and unauthenticated exploitation are not possible. The specific trigger is interaction with the application's exportData endpoint/component, which improperly exposes information (CWE-200). Limiting factors: the local-only vector confines risk to users who already have a foothold on the host (e.g., shared/multi-user desktops); impact is limited to confidentiality (VC:L) with no integrity or availability effect; and the vendor states the vulnerable code paths do not exist in supported 2.0.x releases, so only the legacy 1.1.x branch is realistically affected.

This is a low-to-moderate real-world risk, not a priority for most environments. The CVSS 4.0 base score is 4.8 (medium), and the vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N confirms the ceiling on severity: exploitation requires LOCAL access (AV:L) and existing low-privilege authentication (PR:L), and the only impact is LOW confidentiality (VC:L) with no integrity or availability impact. Publicly available exploit code exists (reflected in the input's POC flag and the E:P 'Proof-of-Concept' exploit-maturity metric), which raises the practical likelihood that an attacker with local access could use it, but this is distinct from active exploitation. The CVE is NOT in CISA KEV, and no EPSS score was provided in the input, so there is no signal of widespread or automated exploitation - consistent with a local-only, low-impact information-disclosure flaw. A significant CONFLICTING signal is the vendor's explicit dispute: HBAI-Ltd states the report targets version 1.1.8, that the current release (2.0.4) is a substantial architectural refactor in which the referenced code paths no longer exist, and that the report 'does not describe a vulnerability in any supported release.' This dispute should be weighed against the fact that the issue was submitted/reported by VulDB rather than confirmed by an independent third party. Net assessment: a high-CVSS headline is absent here (the score is correctly moderate), and local access plus a disputed, refactored-away code path make this a low operational priority outside of multi-user hosts running the affected 1.1.x build.

A low-privileged user already logged into a shared or multi-user machine running Toonflow-app 1.1.8 or earlier interacts with the exportData endpoint to read information they should not have access to, disclosing sensitive data. Public exploit code is available (hosted on the referenced Google Drive link), lowering the skill needed to reproduce the issue. Because the attack vector is local (AV:L) and requires existing low-level credentials (PR:L), remote or unauthenticated exploitation is not possible.