CVE-2026-109559

Received Received - Intake

Navigation Allowlist Bypass in EdgeEver Desktop

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109559

Affected Vendors & Products

Vendor	Product	Version / Range
tianma-if	EdgeEver	1.6.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

EdgeEver Desktop versions 1.6.26 through 1.112.0 have a navigation allowlist bypass vulnerability. This flaw allows attackers to bypass URL restrictions and load arbitrary origins in the main window using string-prefix matching. Attackers can exploit this by embedding a link with userinfo syntax after the dev-server prefix, such as in a note-template preview, to gain access to the EdgeEver Desktop bridge including session tokens, sidecar RPC, and ACP channels.

Detection Guidance

Detecting this vulnerability requires checking for EdgeEver Desktop versions 1.6.26 through 1.112.0 and inspecting for navigation allowlist bypass attempts. Review logs for URLs containing userinfo syntax after dev-server prefixes in note-template previews or similar contexts.

Impact Analysis

This vulnerability can allow attackers to gain unauthorized access to sensitive data like session tokens, execute remote procedure calls, and interact with ACP channels. If exploited, it could lead to data breaches, unauthorized actions, or full system compromise depending on the permissions of the affected application.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using EdgeEver Desktop may face compliance violations, legal penalties, and reputational damage if this flaw is exploited to access protected health information or personally identifiable information.

Mitigation Strategies

Immediately update EdgeEver Desktop to a version beyond 1.112.0. Disable or restrict access to note-template preview features if updates are not immediately feasible. Monitor network traffic for suspicious URL patterns involving userinfo syntax.

Hi! I’m here to help you understand CVE-2026-109559. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70