CVE-2026-5302CWE-942

Permissive Cross-domain Policy with Untrusted Domains in coolercontrold

Medium · published April 8, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
31.1
In the wild
Unconfirmed
What it is

CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00383 · 31.1th percentile
Weakness
CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2026-04-08T12:05Z
EPSS history
Timeline
  • 08 APR 12:05Z
    Permissive Cross-domain Policy with Untrusted Domains in coolercontrold
    cvelistv5