Realtime Collaboration Platform — CORS Misconfiguration Leading to Authenticated Data Exposure (CVE-2026-27579)

Metadata

Affected Target

Summary

The realtime-collaboration-platform project configured its Appwrite backend to allow arbitrary cross-origin requests while also enabling Access-Control-Allow-Credentials: true. Because the origin allow-list was effectively unrestricted, an attacker-controlled webpage could issue a credentialed fetch() request to the platform’s /v1/account endpoint, which the victim’s browser would automatically attach the session cookie to. The response — containing the victim’s email address, account identifiers, and MFA status — would then be readable by the malicious origin due to the permissive CORS headers. The included PoC is a single-line fetch call demonstrating the cross-origin credentialed read.

Vulnerability Details

Root Cause

The backend failed to validate the Origin header, either reflecting arbitrary origins or returning a wildcard Access-Control-Allow-Origin: * while also setting Access-Control-Allow-Credentials: true — a combination that browsers should reject but that misconfigured/reflective server logic can still enable in practice, exposing authenticated responses to any origin.

Attack Vector

1. Attacker hosts a malicious webpage on an arbitrary domain.
2. Attacker lures a logged-in victim into visiting the page.
3. The page issues a fetch("https://target-appwrite-endpoint/v1/account", { credentials: "include" }) request; the victim’s browser automatically attaches their session cookie.
4. Because the server trusts the attacker’s origin and allows credentials, the JSON response (email, account ID, MFA status) is readable by the attacker’s script and can be exfiltrated to a remote server.

Impact

Unauthorized disclosure of authenticated user account data (email, identifiers, MFA status) to any attacker-controlled origin, enabling account reconnaissance, targeted phishing, and potential downstream account compromise.

Environment / Lab Setup

Target:   realtime-collaboration-platform instance backed by a misconfigured Appwrite API endpoint
Attacker: Any modern web browser; attacker-hosted HTML/JS page

Proof of Concept

PoC Script

See CVE-2026-27579.js in this folder.

When executed in a victim’s browser (via an attacker-hosted page), the script performs a credentialed cross-origin fetch to the target’s account endpoint and logs the exfiltrated JSON (email, account ID, MFA status) to the console, from where it could be sent to an attacker server.

Detection & Indicators of Compromise

Signs of compromise:

• Account activity or MFA status queries originating from unfamiliar third-party referrers.
• Server logs showing successful authenticated requests from origins outside the platform’s known domains.
• Reports of users receiving targeted phishing shortly after visiting an untrusted third-party site.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/AdityaBhatt3010/CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure on 2026-07-05.