{"id":"CVE-2026-120503","kind":"vulnerability","aliases":["CVE-2026-120503"],"related":[],"title":"GeekezBrowser: public API status endpoint leaks information to local users","description":"A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.","summary":"A flaw in the /api/status endpoint of the GeekezBrowser public API lets a local attacker obtain information the endpoint should not reveal. The sources describe the impact only as information disclosure and do not say what data is exposed.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geekezbrowser","local-api","package"],"not_affected_if":["no-local-shared-access","not-installed"],"how_to_check":"- Check the installed GeekezBrowser version; the sources say versions up to 1.7.2 and 1.8.0 are affected.\n- Look for use of the Public API /api/status endpoint in your deployment.","fix":"- GeekezBrowser: upgrade to `1.8.1`, per the sources.","status":"open","published_at":"2026-11-02T21:17:30+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","triaged_at":"2026-11-02T21:37:09+00:00","updated_at":"2026-11-02T21:37:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T21:37:09Z","model":"claude-haiku-5-5","output":{"fix":"- GeekezBrowser: upgrade to `1.8.1`, per the sources.","reach":"local","title":"GeekezBrowser: public API status endpoint leaks information to local users","impact":"low","summary":"A flaw in the /api/status endpoint of the GeekezBrowser public API lets a local attacker obtain information the endpoint should not reveal. The sources describe the impact only as information disclosure and do not say what data is exposed.","audience":"developers","category":"package","nicknames":[],"who_cares":["geekezbrowser","local-api"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"local attacker reads information exposed by the status endpoint","analyst_note":"Confirm what data /api/status exposes and whether the exploit is public, using the NVD entry and the linked patch commit 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e.","how_to_check":"- Check the installed GeekezBrowser version; the sources say versions up to 1.7.2 and 1.8.0 are affected.\n- Look for use of the Public API /api/status endpoint in your deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","no-local-shared-access"],"who_is_affected":"The sources say the flaw is in the Public API component at /api/status and needs local access. Teams that run GeekezBrowser on shared machines or expose its local API are the ones to look at. Machines where it is not installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000703,"input_tokens":4222,"output_tokens":561,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-120503':13A,16A '-2026':12A,15A '/1.8.0':71C '/api/status':26B,80C '1.7.2':70C '1.8.1':110C '9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e':122C 'abl':112C 'affect':73C,125C 'api':3A,20B,32B,85C 'approach':97C 'attack':36B,93C 'compon':83C,126C 'cve':11A,14A 'data':58B 'describ':46B 'detect':64C 'disclosur':52B,91C 'echoh':66C 'endpoint':5A,27B,40B 'exploit':99C 'expos':60B 'file':79C 'flaw':23B 'geekezbrows':1A,17B,30B,67C 'identifi':120C 'impact':48B 'inform':7A,38B,51B,90C 'issu':116C 'leak':6A 'let':33B 'local':9A,19B,35B,96C 'local-api':18B 'manipul':87C 'may':104C 'mitig':114C 'obtain':37B 'packag':21B 'part':76C 'patch':118C 'public':2A,31B,84C,102C 'recommend':128C 'requir':94C 'result':88C 'reveal':43B 'say':56B 'sourc':45B 'status':4A 'unknown':75C 'upgrad':107C,123C 'use':106C 'user':10A 'version':109C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"The sources say the flaw is in the Public API component at /api/status and needs local access. Teams that run GeekezBrowser on shared machines or expose its local API are the ones to look at. Machines where it is not installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["geekezbrowser","localapi","low","package"],"first_public_at":"2026-11-02T21:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120503","severity":null,"published_at":"2026-11-02T21:17:30+00:00","modified_at":"2026-11-02T21:17:30+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","fetched_at":"2026-11-02T21:35:41+00:00","note":null}],"documents":[{"id":53941,"url":"https://github.com/EchoHS/GeekezBrowser/commit/9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":53942,"url":"https://github.com/EchoHS/GeekezBrowser/releases/tag/v1.8.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}