CVE-2026-28201
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
67/100
Published: 2026-05-07
Modified: 2026-11-11
First seen: 2026-11-11
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| lfnovo | open-notebook | < 1.8.3 |
References & Advisories (1)
Vendor Advisory