Raindrop.io Bookmark Manager CVE-2026-31192

Remote unauthenticated attackers can exploit this vulnerability without special conditions beyond network access to the Raindrop.io web application and knowledge or discovery of how extension identifiers are validated. The vulnerability requires neither authentication nor user interaction. It affects all users of Raindrop.io version 5.6.76.0 who have the web app deployed and accessible. The primary limiting factor is that attackers must correctly format a request that mimics legitimate extension communication, which may require reverse-engineering the extension-to-web-app communication protocol through browser developer tools or GitHub research (as indicated by the public research link). Non-vulnerable configurations would require cryptographic extension ID signing or strict whitelisting of known extension IDs at the server level, rather than accepting arbitrary identifiers. Default Raindrop.io installations without additional hardening are vulnerable.

CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network-accessible exploitation with low attack complexity and no authentication required, yielding medium real-world risk. The EPSS score and active exploitation status are not provided in available data. The primary concern is the combination of network accessibility and lack of user interaction requirements, which significantly lowers the barrier to exploitation. However, CVSS does not capture the actual exploitability of extension identifier validation flaws, which typically require knowledge of legitimate extension IDs or discovery of valid identifiers through reconnaissance. The low confidentiality and integrity impact (C:L/I:L) suggests the attacker gains partial access to user data or can make limited unauthorized modifications, not complete system compromise. The absence of availability impact (A:N) indicates this is not a denial-of-service vector. The information disclosure component (per tags) is the primary threat. Without confirmation of active exploitation or public POC accessibility, the real-world risk is moderate - security teams should prioritize remediation but not treat as critical emergency. The nature of a web app vulnerability (not native code) also limits the severity compared to system-level flaws.

An attacker performs reconnaissance to identify valid Chrome extension IDs used by Raindrop.io or discovers that the application accepts arbitrary extension identifiers. The attacker crafts an HTTP request to a sensitive Raindrop.io API endpoint (e.g., user data export, bookmark list retrieval) with a forged extension identifier in the request header or body, bypassing the insufficient validation logic. The server, trusting the identifier without cryptographic verification, returns sensitive user data such as bookmarks, user preferences, or metadata. The attacker extracts and exfiltrates this information. No user interaction is required because the request is sent directly to the server, not through a user's browser, enabling large-scale automated exploitation.