Live › vulnerability › CVE-2026-120503
A flaw in the /api/status endpoint of the GeekezBrowser public API lets a local attacker obtain information the endpoint should not reveal. The sources describe the impact only as information disclosure and do not say what data is exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
The sources say the flaw is in the Public API component at /api/status and needs local access. Teams that run GeekezBrowser on shared machines or expose its local API are the ones to look at. Machines where it is not installed can skip it.
No product ranges from the sources yet.
1.8.1, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.
This page as .md · .json · in your agent: get_signal("CVE-2026-120503")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.