Critical, CVSS 9.0GoPublished
qui CORS Misconfiguration: Arbitrary Origins Trusted
CVE-2026-30924 · GHSA-h8vw-ph9r-xpch
- Affected
- Go github.com/autobrr/qui < 1.15.0
- Fixed in
- 1.15.0· Vendor fix available
- Issue
- The application implements an HTML5 cross-origin resource sharing (CORS) policy that allows access from any domain. While the application is typically deployed within a trusted local network, successful exploitation of this weakness does not require any direct access to the instance by the attacker. Exploitation of this vulnerability uses the victim's browser as a conduit for interaction with the application. The mechanism used is a malicious webpage that requests from or posts to sensitive application paths upon load. This may be made transparent to the user, and harvested data may be sent back to the attacker upon success. Cause and Remedy The above response headers are responsible for the vulnerability. Access-Control-Allow-Origin was found to reflect arbitrary origins, implementing an effective blanket whitelist. Additionally, Access-Control-Allow-Credentials was returned as true, indicating to the browser that the loaded resource was permitted to leverage saved session…
Recommended action: Upgrade to 1.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.