CVE-2026-15594

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15594

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15594.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15594

Published

2026-07-13T20:15:10.868Z

Modified

2026-07-17T03:41:50.334525345Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization

Details

A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15594.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/waooai/waoowaoo

Affected ranges

Type

GIT

Repo

https://github.com/waooai/waoowaoo

Events

Introduced

77a130351086cb6d5f9572ce4645e7790c64a46b

Last affected

531de26d48869602b5b2d730a3743cf077a0213f

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.4.0"
        },
        {
            "last_affected": "0.4.0"
        },
        {
            "introduced": "0.4.1"
        },
        {
            "last_affected": "0.4.1"
        }
    ]
}

Affected versions

0.*

0.4.0

0.4.1

v0.*

v0.4.0

v0.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15594.json"