EUVD-2026-20461
GHSA-vhqm-xjcf-g4x8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites
AnalysisAI
CORS misconfiguration in CoolerControl coolercontrold versions 2.0.0 through 3.x allows unauthenticated remote attackers to read sensitive data and send control commands to the service by exploiting browser-based cross-origin requests from malicious websites. The vulnerability requires user interaction (UI:R) but grants attackers capability to leak information and manipulate daemon operations with a CVSS score of 6.3 (medium).
Technical ContextAI
CoolerControl's coolercontrold service implements a REST API that fails to properly enforce Cross-Origin Resource Sharing (CORS) restrictions, classified under CWE-942 (Permissive Cross-domain Policy). The vulnerability exists in the API module (mod.rs at line 374 based on the GitLab reference) where CORS headers are either missing, overly permissive (e.g., Access-Control-Allow-Origin: *), or incorrectly configured. This allows any website visited by a user to issue requests to the local coolercontrold service running on the same machine. The affected product is coolercontrold (CPE: cpe:2.3:a:coolercontrol:coolercontrold:*:*:*:*:*:*:*:*), with all versions from 2.0.0 up to and including 3.x vulnerable.
RemediationAI
Vendor-released patch: upgrade to coolercontrold 4.0.0 or later. This release, available at https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0, resolves the CORS misconfiguration by implementing proper cross-origin request validation. Users unable to upgrade immediately should restrict network access to the coolercontrold service or disable the HTTP API if not required. Review and validate CORS headers in the API module (mod.rs) to ensure they specify only trusted origins or implement credential-based authentication for sensitive endpoints.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditional
Cross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today