---
id: "CVE-2026-120503"
kind: "vulnerability"
aliases: ["CVE-2026-120503"]
title: "GeekezBrowser: public API status endpoint leaks information to local users"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["geekezbrowser", "local-api", "package"]
not_affected_if: ["no-local-shared-access", "not-installed"]
published_at: "2026-11-02T21:17:30+00:00"
first_seen_at: "2026-11-02T21:35:41+00:00"
updated_at: "2026-11-02T21:37:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120503", "first_seen_at": "2026-11-02T21:35:41+00:00"}]
---

# GeekezBrowser: public API status endpoint leaks information to local users

A flaw in the /api/status endpoint of the GeekezBrowser public API lets a local attacker obtain information the endpoint should not reveal. The sources describe the impact only as information disclosure and do not say what data is exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GeekezBrowser version; the sources say versions up to 1.7.2 and 1.8.0 are affected.
- Look for use of the Public API /api/status endpoint in your deployment.

## Fix

- GeekezBrowser: upgrade to `1.8.1`, per the sources.

## Timeline

- 2026-11-02T21:35:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120503

## Documents

- [fix] Patch: github.com https://github.com/EchoHS/GeekezBrowser/commit/9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e
- [fix] Release notes: github.com https://github.com/EchoHS/GeekezBrowser/releases/tag/v1.8.1

## From the sources

A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_