What is the CVSS score of CVE-2026-5302?

CVE-2026-5302 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-5302?

Yes, a patch is available for CVE-2026-5302. Update the affected software to the latest version immediately.

Cors Misconfiguration CVE-2026-5302

Q: Which versions of Cors Misconfiguration are affected by CVE-2026-5302?

CORS misconfiguration in CoolerControl coolercontrold versions 2.0.0 through 3.x allows unauthenticated remote attackers to read sensitive data and send control commands to the service by exploiting…. A patch is available.

EUVD-2026-20461 HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-04-08 GitLab

GHSA-vhqm-xjcf-g4x8

Information Disclosure Cors Misconfiguration Coolercontrold Coolercontrol

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Jul 24, 2026 - 20:22 NVD

6.3 (MEDIUM) 8.1 (HIGH)

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.0

EUVD ID Assigned

Apr 08, 2026 - 13:16 euvd

EUVD-2026-20461

Analysis Generated

Apr 08, 2026 - 13:16 vuln.today

CVE Published

Apr 08, 2026 - 12:05 nvd

MEDIUM 6.3

DescriptionNVD

CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites

AnalysisAI

CORS misconfiguration in CoolerControl coolercontrold versions 2.0.0 through 3.x allows unauthenticated remote attackers to read sensitive data and send control commands to the service by exploiting browser-based cross-origin requests from malicious websites. The vulnerability requires user interaction (UI:R) but grants attackers capability to leak information and manipulate daemon operations with a CVSS score of 6.3 (medium).

Technical ContextAI

CoolerControl's coolercontrold service implements a REST API that fails to properly enforce Cross-Origin Resource Sharing (CORS) restrictions, classified under CWE-942 (Permissive Cross-domain Policy). The vulnerability exists in the API module (mod.rs at line 374 based on the GitLab reference) where CORS headers are either missing, overly permissive (e.g., Access-Control-Allow-Origin: *), or incorrectly configured. This allows any website visited by a user to issue requests to the local coolercontrold service running on the same machine. The affected product is coolercontrold (CPE: cpe:2.3:a:coolercontrol:coolercontrold:*:*:*:*:*:*:*:*), with all versions from 2.0.0 up to and including 3.x vulnerable.

RemediationAI

Vendor-released patch: upgrade to coolercontrold 4.0.0 or later. This release, available at https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0, resolves the CORS misconfiguration by implementing proper cross-origin request validation. Users unable to upgrade immediately should restrict network access to the coolercontrold service or disable the HTTP API if not required. Review and validate CORS headers in the API module (mod.rs) to ensure they specify only trusted origins or implement credential-based authentication for sensitive endpoints.