EUVD-2026-40392
GHSA-fq2g-wf56-3prg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CORS abuse is browser-mediated so an authenticated victim must interact (UI:R); attacker is unauthenticated (PR:N); confidentiality high plus limited 'privileged actions' give C:H/I:L.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
6DescriptionNVD
IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
AnalysisAI
Sensitive information disclosure and unauthorized privileged actions in IBM DevOps Deploy (formerly UrbanCode Deploy/UCD) versions 8.1.0 through 8.1.2.6 and 8.2.0 through 8.2.1.0 stem from an overly permissive Cross-Origin Resource Sharing (CORS) policy that fails to restrict requests to trusted domains. An attacker who lures an authenticated user to a malicious web page can leverage the victim's session across origins to read confidential data and invoke privileged operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the affected component's misconfigured CORS policy (present by default in DevOps Deploy 8.1.0-8.1.2.6 and 8.2.0-8.2.1.0) to reflect or trust untrusted origins, and - because the attack is browser-mediated - a currently authenticated DevOps Deploy user must visit or interact with an attacker-controlled web page while their session is valid. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are broadly consistent toward moderate, not urgent, risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page and sends a phishing link to a DevOps Deploy operator who has an active authenticated console session. When the operator opens the page, embedded JavaScript issues cross-origin requests to the DevOps Deploy API; because the CORS policy accepts the attacker's origin, the browser returns the authenticated responses, letting the attacker exfiltrate sensitive deployment data and trigger privileged actions under the victim's identity. … |
| Remediation | Patch available per vendor advisory: consult IBM Support advisory https://www.ibm.com/support/pages/node/7277575 and apply the fixed release for your branch (an exact fixed version is not stated in the available data and should be taken directly from the IBM advisory rather than assumed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: restrict network access to IBM DevOps Deploy to internal IP ranges only; audit current user sessions; distribute security awareness messaging on phishing risks targeting deployment tool users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditional
Cross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today