CVE-2026-30924

The Qui application server incorrectly configures the CORS policy — it reflects any value of the Origin header sent by the browser while also allowing session cookies to be included (Access-Control-Allow-Credentials: true). An attacker creates a malicious website to which they lure the victim using social engineering methods. After the page loads, the victim's browser automatically sends authenticated requests to the Qui application within the context of the user's active session. This way, the attacker can silently exfiltrate sensitive data or issue commands through the built-in External Programs manager.

An attacker can gain access to API keys, credentials, and other sensitive information managed by the application, and through the External Programs manager mechanism can achieve full control over the operating system on which the application runs.

At the time of vulnerability publication, no patch was available. Monitor the vendor's repository (https://github.com/autobrr/qui) for patch releases. As a temporary workaround, it is recommended to expose the Qui application only on localhost or restrict access to it using a firewall or VPN, which prevents the conditions necessary for exploitation.

Getqui Qui in versions 1.14.1 and earlier. A successful attack requires the victim to access the application through an address other than localhost and to visit a page controlled by the attacker.