CVE-2026-53656: CWE-346: Origin Validation Error in voxel51 fiftyone

FiftyOne versions prior to 1.17.0 have an origin validation vulnerability (CWE-346) where the server responds with Access-Control-Allow-Origin: * headers unconditionally. This allows cross-origin resource sharing from any origin, which combined with the /media endpoint accepting filesystem paths, enables a malicious website to read arbitrary files accessible to the server process and exfiltrate them without additional user interaction. The issue is resolved in version 1.17.0 by making cross-origin access explicit through the allowed_origins configuration and FIFTYONE_ALLOWED_ORIGINS environment variable, with the default policy changed to same-origin.

An attacker can exploit this vulnerability by hosting a malicious website that a user visits, allowing the attacker to read sensitive files accessible to the FiftyOne server process via the /media endpoint. This results in confidentiality loss without requiring user interaction beyond visiting the malicious site. The vulnerability does not allow modification or denial of service but can lead to significant data exposure.

Upgrade to FiftyOne version 1.17.0 or later, where this vulnerability is fixed by enforcing explicit cross-origin access controls. Configure allowed_origins or the FIFTYONE_ALLOWED_ORIGINS environment variable to restrict cross-origin requests. No other mitigations are indicated by the vendor advisory.