Improper Authorization in Genspark AI Workspace App

Publication date: 2026-06-14

Last updated on: 2026-06-14

Assigner: VulDB

Description

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. The manipulation leads to improper authorization in handler for custom url scheme. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-14

Last Modified

2026-06-14

Generated

2026-07-05

AI Q&A

2026-06-15

EPSS Evaluated

2026-07-03

NVD

CVE-2026-12190

EUVD

EUVD-2026-36669

Affected Vendors & Products

Vendor	Product	Version / Range
genspark	ai_workspace_app	2.8.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-939	The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Genspark AI Workspace App version 2.8.4 on Android. It involves improper authorization in the handler for a custom URL scheme within the component ai.mainfunc.genspark. The flaw allows an attacker to manipulate the app's behavior, but the attack can only be executed from a local environment.

Impact Analysis

The vulnerability can lead to improper authorization, which means an attacker with local access could potentially perform unauthorized actions within the app. This could compromise the integrity, confidentiality, or availability of the app's functions or data, depending on what the custom URL scheme controls.

Hi! I’m here to help you understand CVE-2026-12190. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70