CVE-2026-12190CWE-285CWE-939

Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme

Medium · published June 14, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. The manipulation leads to improper authorization in handler for custom url scheme. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00105 · 1.0th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-939 · Improper Authorization in Handler for Custom URL Scheme
Published
2026-06-14T22:45Z
EPSS history
Timeline
  • 14 JUN 22:45Z
    Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme
    cvelistv5