EUVD-2026-40392
GHSA-fq2g-wf56-3prg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CORS abuse is browser-mediated so an authenticated victim must interact (UI:R); attacker is unauthenticated (PR:N); confidentiality high plus limited 'privileged actions' give C:H/I:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
AnalysisAI
Sensitive information disclosure and unauthorized privileged actions in IBM DevOps Deploy (formerly UrbanCode Deploy/UCD) versions 8.1.0 through 8.1.2.6 and 8.2.0 through 8.2.1.0 stem from an overly permissive Cross-Origin Resource Sharing (CORS) policy that fails to restrict requests to trusted domains. An attacker who lures an authenticated user to a malicious web page can leverage the victim's session across origins to read confidential data and invoke privileged operations. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Technical ContextAI
IBM DevOps Deploy is an enterprise application-release-automation platform (the rebranded IBM UrbanCode Deploy) that orchestrates deployments across environments through a web-based console and REST API. The root cause is CWE-942 (Permissive Cross-domain Policy with Untrusted Domains): the server's CORS configuration reflects or accepts arbitrary Origin values rather than whitelisting only trusted domains, so browsers permit cross-origin JavaScript to read authenticated responses. Because DevOps Deploy manages deployment pipelines and credentials, the console holds sensitive operational data, and its API supports privileged state-changing actions - both of which become reachable cross-origin when the Access-Control-Allow-Origin policy is misconfigured. The two affected CPEs (cpe:2.3:a:ibm:devops_deploy) cover the 8.1.x and 8.2.x branches.
RemediationAI
Patch available per vendor advisory: consult IBM Support advisory https://www.ibm.com/support/pages/node/7277575 and apply the fixed release for your branch (an exact fixed version is not stated in the available data and should be taken directly from the IBM advisory rather than assumed). As a compensating control until patched, place the DevOps Deploy web console and API behind a reverse proxy or WAF that enforces a strict Access-Control-Allow-Origin allowlist of only trusted internal domains and strips reflected Origin headers - this neutralizes the cross-origin read without altering application logic, though it requires enumerating every legitimate front-end origin to avoid breaking integrations. Additionally restrict console/API network exposure to trusted management networks or VPN, which reduces the pool of victims an attacker can target but does not stop a compromised internal browser. Enforcing short session lifetimes and requiring re-authentication for privileged actions further limits the window in which a lured authenticated session can be abused.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today