What is the CVSS score of EUVD-2026-44670?

EUVD-2026-44670 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Cors Misconfiguration are affected by EUVD-2026-44670?

LightRAG server versions before 1.5.4 contain a critical vulnerability allowing attackers to hijack authenticated user sessions and steal or destroy sensitive knowledge-base data when victims visit…. A patch is available.

How to fix or mitigate EUVD-2026-44670?

Within 24 hours, audit all LightRAG deployments to identify instances running versions prior to 1.5.4 and assess data criticality. Within 7 days, deploy the vendor patch to version 1.5.4 across all systems, prioritizing production instances first, or if upgrading immediately is not feasible, restrict access via network controls and disable cross-domain requests at the application layer. Within 30 days, confirm patch deployment across all systems, review access logs for evidence of exploitation, and verify no instances remain pre-1.5.4.

Cors Misconfiguration EUVD-2026-44670

| CVE-2026-61736 CRITICAL

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-07-15 GitHub_M

Cors Misconfiguration Information Disclosure Lightrag

9.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 15:17 vuln.today

Analysis Generated

Jul 15, 2026 - 15:17 vuln.today

CVE Published

Jul 15, 2026 - 14:12 cve.org

CRITICAL 9.3

DescriptionCVE.org

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.

AnalysisAI

Cross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, credentialed API calls on behalf of a logged-in victim because the server ships with CORS_ORIGINS=* paired with allow_credentials=True. When an authenticated LightRAG user browses to an attacker-controlled page, that page can silently read documents and knowledge-graph data or issue destructive requests such as deleting the entire document store. …