CVE-2026-27579

CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure

State: Published
Severity: 7.4 High
Published: Feb 21, 2026
Updated: Feb 24, 2026
Reserved: Feb 20, 2026

Read the record on cve.org

Description

CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-346 Origin Validation Error
CWE-942 Permissive Cross-domain Policy with Untrusted Domains

Affected Products

Product	Versions
realtime-collaboration-platformkarnop	<= masterAffected

References

https://github.com/karnop/realtime-collaboration-platform/security/advisories/GHSA-qh5m-p8jh-hx88

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.