PT-2026-2470 · Unknown · Eramba Community Edition+1

Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-55462

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eramba Community and Enterprise Editions versions prior to 3.26.0

Description A Cross-Origin Resource Sharing (CORS) misconfiguration exists that allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response, along with Access-Control-Allow-Credentials: true. This enables malicious third-party websites to perform authenticated cross-origin requests against the Eramba API. Affected API endpoints include '/system-api/login' and '/system-api/user/me'. The response contains sensitive user session data, including ID, name, email, and access groups, which can be accessed by attacker JavaScript. This allows for full session hijack and data exfiltration without user interaction.

Recommendations Update to a version newer than 3.26.0.

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2025-55462

Affected Products

Eramba Community Edition

Eramba Enterprise Edition

References · 5

• https://osv.dev/vulnerability/CVE-2025-55462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55462 · Security Note
• http://eramba.com · Note
• https://twitter.com/CVEnew/status/2011096087952846942 · Twitter Post
• https://discussions.eramba.org/t/release-3-28-0/7860 · Note