CVE-2026-27579: karnop realtime-collaboration-platform · Origin Validation Error
Affects karnop realtime-collaboration-platformSource CVE Database V5
Not known to be exploited · CVSS 7.4 High.
Data as of 30 Oct 2026, 06:59 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 21 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| karnoprealtime-collaboration-platform | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, organizations should immediately audit and restrict the CORS configuration in the Appwrite backend and the realtime-collaboration-platform. Specifically, they must: 1) Remove the wildcard or arbitrary origin allowance in CORS headers and explicitly specify trusted origins only. 2) Disable credentialed CORS requests (i.e., do not set Access-Control-Allow-Credentials to true) unless absolutely necessary and only for trusted origins. 3) Implement strict origin validation logic server-side to ensure requests originate from authorized domains. 4) Employ Content Security Policy (CSP) headers to limit the domains that can execute scripts or embed the application. 5) Educate users to avoid visiting untrusted or suspicious websites while logged into the platform. 6) Monitor network traffic and logs for anomalous cross-origin requests or unusual data access patterns. 7) Follow the vendor’s updates closely and apply patches promptly once available. 8) Consider deploying Web Application Firewalls (WAFs) with rules to detect and block suspicious CORS misuse. These steps go beyond generic advice by focusing on precise CORS policy hardening and proactive monitoring tailored to this vulnerability’s exploitation vector.
Description
CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication.