CVE-2026-97155 describes a vulnerability in Fabasoft Folio Client prior to 2026 where the client fails to properly restrict web origins that can invoke its functions via web messaging. The registry value VALIDDOMAINS, which should limit allowed origins, was optional and empty by default, resulting in all domains being trusted. This origin validation error (CWE-346) allows any website visited by the user to invoke sensitive client functions such as document download, opening, and synchronization. The issue is fixed in Fabasoft Folio Client 2026 builds 26.0.0.10 and 26.4.0.76.

An attacker controlling a website visited by a user with the vulnerable Folio Client and browser extension installed could invoke client functions without restriction. This could lead to unauthorized actions such as downloading, opening, or synchronizing documents, impacting the integrity of client data. The CVSS 3.1 score is 6.5 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Fixed versions of Fabasoft Folio Client are available starting with 2026 builds 26.0.0.10 and 26.4.0.76. Users and administrators should upgrade to these or later versions to remediate the vulnerability. There is no indication that temporary or alternative mitigations are provided. Patch status is confirmed by the vendor advisory stating the fixed builds.