O2OA CVE-2026-97179

Requires an authenticated session on the O2OA server (PR:L) with network reachability to the Cipher Connection Handler endpoint; the attacker must supply a manipulated fileUrl argument to the list function in CipherConnectionAction.java. No user interaction is needed (UI:N) and complexity is low. Exploitation is limited by the authentication requirement and by O2OA's small deployment base; only servers exposing the affected endpoint to the (authenticated) attacker are at risk. No non-default configuration is stated as necessary, but no patched version has been published because the vendor did not respond.

This is a moderate-severity, moderate-real-risk issue rather than an emergency. All signals align at the mid-low end: the vendor/VulDB CVSS 4.0 score is 5.3 with vector AV:N/AC:L/PR:L/UI:N and only VC:L (limited confidentiality, no integrity or availability impact), CWE-200 confirms information disclosure as the sole outcome. SSVC-relevant signals: exploitation status is 'proof-of-concept' (E:P in the 4.0 vector), technical impact is partial (info disclosure only), and the flaw is network-reachable but requires low-level authentication (PR:L). A public exploit exists (GitHub 2H-K/myvuls), which raises practical concern, but this must NOT be conflated with active exploitation - there is no CISA KEV listing and no EPSS score provided, so widespread automated exploitation is unproven. The dominant risk-limiting factors are: (1) authentication is required (PR:L per the CVSS vector), and (2) the affected product, O2OA, has a small real-world footprint. The bounded impact (read-only disclosure, no code execution) keeps this well below critical priority. Note a possible under-scoping: a fileUrl argument that the server fetches often implies SSRF-style behavior that could reach internal resources, but the assigned vector caps confidentiality at VC:L/C:L - if the fetched content can reach sensitive internal endpoints, true impact could be higher; verify with source code before deprioritizing entirely.

An authenticated low-privilege user of an internet-reachable O2OA server sends a crafted request to the Cipher Connection Handler with a manipulated fileUrl argument, causing the server to disclose file contents or data it should not return. A public proof-of-concept is available on GitHub (2H-K/myvuls issue #3), lowering the skill needed to reproduce it. Because attack complexity is low (AC:L) and no user interaction is required, a valid account is the main barrier.