CVE-2026-49447

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49447
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49447.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49447
Aliases
Published
2026-07-28T20:35:36.636Z
Modified
2026-08-01T03:32:58.981074060Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
Details

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49447.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/azukaar/cosmos-server

Affected ranges

Type
GIT
Repo
https://github.com/azukaar/cosmos-server
Events
Introduced
88de73dcca50172393a75de0e4dc3ab93622825c
Fixed
59c561d686c8f9843b3e092b50f6346c481d8bbf
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.22.18"
        },
        {
            "last_affected": "0.22.18"
        }
    ]
}

Affected versions

0.*
0.22.18
v0.*
v0.22.18

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49447.json"