CVE-2025-55462 describes a Cross-Origin Resource Sharing (CORS) misconfiguration in Eramba Community and Enterprise Editions starting from version 3.26.0. The vulnerability arises because the application reflects the Origin header from attacker-controlled requests in the Access-Control-Allow-Origin response header while also setting Access-Control-Allow-Credentials to true. This combination permits malicious third-party websites to make authenticated cross-origin API requests, including to sensitive endpoints like /system-api/login and /system-api/user/me. The API responses include sensitive user session information accessible to attacker-controlled JavaScript, enabling session hijacking and data exfiltration without user interaction. Testing indicates that versions 3.23.3 and earlier are unaffected, and the vulnerability is present in default installations without requiring any custom configuration.

An attacker can exploit this vulnerability to perform authenticated cross-origin requests to the Eramba API from a malicious website, gaining access to sensitive user session data such as user ID, name, email, and access groups. This exposure allows full session hijacking and unauthorized data exfiltration without requiring any user interaction. The confidentiality of user session information is compromised, but integrity and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting or validating allowed Origin headers in CORS configurations as a temporary mitigation. Monitor vendor communications for updates on patches or official fixes.