CVE-2025-55462 Misconfiguration in n/a

Medium 6.5 Published 13 Jan 2026 Updated 5 Jul 2026

CORS misconfiguration allows attackers to hijack sessions and exfiltrate sensitive user data via malicious cross-origin requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-55462?

CVE-2025-55462 is a medium-severity vulnerability in n/a, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.

Weakness: CWE-942

Which versions are affected by CVE-2025-55462?

It affects 1 product.

Products include Eramba Eramba.

How do I fix CVE-2025-55462?

No fix has been published for CVE-2025-55462 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-55462 being exploited?

There is no known exploitation of CVE-2025-55462 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-7mf2-39xh-3vq6.