CVE-2024-8026 HIGH

CVE-2024-8026: CSRF due to overly permissive CORS headers in netease-youdao/qanything

Vendor Netease-Youdao
Product netease-youdao/qanything
Weakness CWE-352 · CSRF
Published March 20, 2025
Last update March 20, 2025
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated