CVE-2026-30924: qui CORS Misconfiguration: Arbitrary Origins Trusted

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.5%, percentile 39: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 39% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Only applies if your dependency tree includes github.com/autobrr/qui (Go) < 1.15.0, fixed in 1.15.0. Check your lockfile, including transitive dependencies.

What it is

qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a logged-in user. An attacker can exploit this by tricking a victim into loading a malicious webpage, which silently interacts with the application using the victim's session and potentially exfiltrating sensitive data such as API keys and account credentials, or even achieving full system compromise through the built-in External Programs manager. Exploitation requires that the victim access the application via a non-localhost hostname and load an attacker-controlled webpage, making highly targeted social-engineering attacks the most likely real-world scenario. This issue was not fixed at the time of publication.

From the GitHub advisory

Summary The application implements an HTML5 cross-origin resource sharing (CORS) policy that allows access from any domain.

While the application is typically deployed within a trusted local network, successful exploitation of this weakness does not require any direct access to the instance by the attacker. Exploitation of this vulnerability uses the victim's browser as a conduit for interaction with the application.

The mechanism used is a malicious webpage that requests from or posts to sensitive application paths upon load. This may be made transparent to the user, and harvested data may be sent back to the attacker upon success.

Cause and Remedy

The above response headers are responsible for the vulnerability. Access-Control-Allow-Origin was found to reflect arbitrary origins, implementing an effective blanket whitelist. Additionally, Access-Control-Allow-Credentials was returned as true, indicating to the browser that the loaded resource was permitted to leverage saved session information.

Weakness type: CWE-942.

Product: github.com/autobrr/qui (Go) · Assigned by: GitHub_M · Published: 2026-03-19

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: present (depends on deployment conditions)
• Privileges required: none (no login)
• User interaction: passive

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 0.46% probability of exploitation activity in the next 30 days; percentile 39.

Timeline

• 2026-03-19 — CVE record published by GitHub_M
• 2026-03-19 — GitHub-reviewed advisory GHSA-h8vw-ph9r-xpch published (critical)
• 2026-03-20 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-h8vw-ph9r-xpch github.com
2. CVE.org record CVE-2026-30924 cve.org
3. NVD entry CVE-2026-30924 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com

Critical Go advisories · Today’s Security Digest