CVE-2026-7581

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-7581

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7581.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-7581

Published

2026-05-01T13:00:21.405Z

Modified

2026-07-15T01:49:13.757475276Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy

Details

A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the function on_prepare of the file app/main.py of the component CORS Policy. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.04.10 is able to mitigate this issue. The identifier of the patch is 0072d3488ae5b8d922d3ee87458d829993742a32. It is recommended to upgrade the affected component.

Database specific

{
    "cwe_ids": [
        "CWE-346",
        "CWE-942"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7581.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/alexta69/metube

Affected ranges

Type

GIT

Repo

https://github.com/alexta69/metube

Events

Introduced

0b3645aea1546f74fc6b26e7936e51863248079e

Fixed

0072d3488ae5b8d922d3ee87458d829993742a32

Fixed

388aeb180d48f09468aaa7b1f377f7fc247f73ef

Database specific

{
    "extracted_events": [
        {
            "introduced": "2026.04.09"
        },
        {
            "last_affected": "2026.04.09"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2026.*

2026.04.09

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7581.json"