Dashboard / CVE-2026-45243

CVE-2026-45243

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-05-18 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
AT: None
VC: None
VI: None
VA: None

Description

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
steipete summarize 0 < 0.15.1

References & Advisories (4)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.19%
Raw Score 0.001950
Percentile 9.2%
Date 2026-11-08

Intelligence Sources

mitre ref →

External Links