PT-2026-53204 · Cherryhq · Cherry-Studio

Dem0000 · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-13534

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CherryHQ cherry-studio versions prior to 1.9.8

Description An authorization bypass exists in the CherryIN Preload API component. A remote attacker can bypass authorization by manipulating the state argument within the sha256() function located in the src/main/services/memory/MemoryService.ts file. The attack complexity is high and exploitability is considered difficult.

Recommendations Update to a version newer than 1.9.7. As a temporary mitigation, restrict access to the sha256() function in the src/main/services/memory/MemoryService.ts file.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-13534

Affected Products

Cherry-Studio

References · 9

• 🔥 https://github.com/CherryHQ/cherry-studio/issues/15411 · Exploit
• https://github.com/CherryHQ/cherry-studio/pull/15413 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-13534 · Security Note
• https://vuldb.com/submit/841998 · Note
• https://vuldb.com/vuln/374542 · Note
• https://twitter.com/VulmonFeeds/status/2071495027973337328 · Twitter Post
• https://github.com/CherryHQ/cherry-studio · Note
• https://vuldb.com/cve/CVE-2026-13534 · Note
• https://vuldb.com/vuln/374542/cti · Note