CVE-2026-97155
Received Received - Intake

Fabasoft Folio Client Origin Validation Bypass

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97155
EUVD
EUVD-2026-85790

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fabasoft folio_client to 2026 (exc)
fabasoft fabasphere_enterprise_client to 2026 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Fabasoft Folio Client before 2026 allows any website to invoke client functions like downloading or opening documents due to a default lack of origin restrictions. The VALIDDOMAINS registry setting, which should limit trusted domains, was optional and empty by default, enabling all domains to interact with the client.

Detection Guidance

Check if the VALIDDOMAINS registry key exists under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Fabasoft\NativeClient\Folio. If it is missing or empty, the system is vulnerable. Use reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Fabasoft\NativeClient\Folio" /v VALIDDOMAINS to inspect the value.

Impact Analysis

An attacker could trick a user into visiting a malicious website that exploits this flaw to perform unauthorized actions such as downloading sensitive documents, opening files, or synchronizing files without the user's knowledge or consent.

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected versions may face compliance risks due to potential data breaches.

Mitigation Strategies

Update to Fabasoft Folio Client 2026 (Build 26.0.0.10) or later. Configure the VALIDDOMAINS registry key under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Fabasoft\NativeClient\Folio to explicitly list allowed domains. Use the installer argument VALIDDOMAINS during deployment if needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart