CVE-2026-109559: Incorrect Authorization in tianma-if EdgeEver

CVE-2026-109559 describes an incorrect authorization vulnerability in tianma-if's EdgeEver Desktop application versions 1.6.26 through 1.112.0. The vulnerability arises from a navigation allowlist bypass that permits attackers to load arbitrary origins in the main application window via string-prefix URL matching. Specifically, attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to gain access to the edgeeverDesktop bridge, including session tokens and RPC channels, which could lead to unauthorized access or actions within the application.

Successful exploitation can lead to unauthorized access to sensitive session tokens and internal communication channels (sidecar RPC and ACP channels) within the EdgeEver Desktop application. This could allow attackers to perform actions with elevated privileges or compromise user sessions. The CVSS 4.0 score of 8.4 (high severity) reflects the network attack vector, low attack complexity, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening untrusted links or note templates that could exploit this vulnerability. Monitor vendor communications for updates and apply patches promptly once released.