This vulnerability (CVE-2026-5302) is due to a CORS misconfiguration in coolercontrold versions before 4.0.0, which allows unauthorized remote attackers to bypass same-origin policy restrictions. By exploiting the permissive cross-domain policy, attackers can perform unauthorized read and command operations on the service through malicious websites. The issue is classified under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). The CVSS v3.1 base score is 6.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to read sensitive data and send commands to the coolercontrold service, potentially compromising confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction (e.g., visiting a malicious website). There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the coolercontrold service from untrusted web origins and implement network-level controls to limit exposure. Monitor vendor channels for updates regarding patches or official mitigations.