Search
Find a vulnerability
Search criteria
10 vulnerabilities by Unblu inc.
CVE-2026-14933 (GCVE-0-2026-14933)
Vulnerability from nvd – Published: 2026-10-20 11:08 – Updated: 2026-10-20 15:28
VLAI
EPSS
VEX
Title
Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
Summary
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.
The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.
Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
8.35.2-hotfix.0 , < 8.35.2
(semver)
Unaffected: 8.37.2-hotfix.2 , < 8.37.2 (semver) Unaffected: 8.38.2-hotfix.0 , < 8.38.2 (semver) Affected: 7.0 , ≤ 7.57.7 (semver) Affected: 8.0 , ≤ 8.39.2 (semver) Unaffected: 8.39.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:28:00.378931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:28:15.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThan": "8.35.2",
"status": "unaffected",
"version": "8.35.2-hotfix.0",
"versionType": "semver"
},
{
"lessThan": "8.37.2",
"status": "unaffected",
"version": "8.37.2-hotfix.2",
"versionType": "semver"
},
{
"lessThan": "8.38.2",
"status": "unaffected",
"version": "8.38.2-hotfix.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.57.7",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.39.2",
"status": "affected",
"version": "8.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.39.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\u003c/p\u003e\u003cp\u003eThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\u003c/p\u003e\u003cp\u003eExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected.\u003c/p\u003e"
}
],
"value": "Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\n\n\n\nThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\n\n\n\nExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:08:43.830Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-004"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin.\u003c/p\u003e"
}
],
"value": "Upgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\n\n\n\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\n\n\n\nFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin."
}
],
"source": {
"advisory": "UBL-2026-004",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Cross-Site Scripting in Embedded Co-Browsing",
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-14933",
"datePublished": "2026-10-20T11:08:43.830Z",
"dateReserved": "2026-07-07T10:56:24.163Z",
"dateUpdated": "2026-10-20T15:28:15.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9589 (GCVE-0-2026-9589)
Vulnerability from nvd – Published: 2026-10-20 11:01 – Updated: 2026-10-20 15:36
VLAI
EPSS
VEX
Title
Unblu Spark Authorization Bypass in Configuration Cascade Operations
Summary
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.
The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.
Exploitation requires an authenticated session but no user interaction.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:35 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Affected:
7.0 , < 8.37.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:35:28.675324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:36:00.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThan": "8.37.0",
"status": "affected",
"version": "7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren\u0027t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers\u0027 accounts, via configuration read and write operations that target those entities.\u003c/p\u003e\u003cp\u003eThe Collaboration Server doesn\u0027t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren\u0027t allowed to edit, in any scope.\u003c/p\u003e\u003cp\u003eExploitation requires an authenticated session but no user interaction.\u003c/p\u003e"
}
],
"value": "Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren\u0027t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers\u0027 accounts, via configuration read and write operations that target those entities.\n\n\n\nThe Collaboration Server doesn\u0027t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren\u0027t allowed to edit, in any scope.\n\n\n\nExploitation requires an authenticated session but no user interaction."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Unblu Cloud"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:01:14.409Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-002"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Unblu Spark 8.37.2 or later. There is no fix for Unblu Spark 7.x.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eThere is no workaround for on-premises deployments.\u003c/p\u003e"
}
],
"value": "Upgrade to Unblu Spark 8.37.2 or later. There is no fix for Unblu Spark 7.x.\n\n\n\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\n\n\n\nThere is no workaround for on-premises deployments."
}
],
"source": {
"advisory": "UBL-2026-002",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Authorization Bypass in Configuration Cascade Operations",
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-9589",
"datePublished": "2026-10-20T11:01:14.409Z",
"dateReserved": "2026-05-26T13:09:34.301Z",
"dateUpdated": "2026-10-20T15:36:00.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8152 (GCVE-0-2026-8152)
Vulnerability from nvd – Published: 2026-07-22 12:21 – Updated: 2026-07-22 18:55
VLAI
EPSS
VEX
Title
Unblu Spark Open Redirect leading to DOM-Based XSS
Summary
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-22 18:54 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Affected:
0 , ≤ 8.36.1
(semver)
Unaffected: 8.36.1-hotfix.0 (semver) Unaffected: 8.37.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:54:56.321413Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:55:07.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThanOrEqual": "8.36.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.36.1-hotfix.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.37.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eUnblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eWhen Unblu Spark is deployed with \u003ccode\u003ecom.unblu.identifier.siteEmbeddedSetup=true\u003c/code\u003e, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 \u2014 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment (same site)"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Cloud deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T12:21:28.977Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIn the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (\u003ccode\u003edocument.location.origin\u003c/code\u003e).\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\n\n\nAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin)."
}
],
"source": {
"advisory": "UBL-2026-001",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Open Redirect leading to DOM-Based XSS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIf you cannot upgrade immediately, either of the following measures prevents exploitation:\u003c/div\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003eEnable the built-in Content Security Policy by setting\u0026nbsp;\u003ccode\u003ecom.unblu.contentsecuritypolicy.mode=on\u003c/code\u003e. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. \u003cb\u003eNote:\u003c/b\u003e\u0026nbsp;this protection is only effective on Unblu Spark \u003cb\u003e7.56.2 or later\u003c/b\u003e\u0026nbsp;in the 7.x series and \u003cb\u003e8.19.1 or later\u003c/b\u003e\u0026nbsp;in the 8.x series, where\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;was removed from the script source policy. Earlier versions ship a CSP that still permits\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;and are not protected by this workaround.\u003c/li\u003e\u003cli\u003eConfigure a WAF rule to block requests that carry a malicious payload in the\u0026nbsp;\u003ccode\u003eredirectOnFailure\u003c/code\u003e\u0026nbsp;parameter (in particular, values containing a\u0026nbsp;\u003ccode\u003ejavascript:\u003c/code\u003e\u0026nbsp;scheme or obfuscated variants such as\u0026nbsp;\u003ccode\u003ejava%0ascript:\u003c/code\u003e).\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "If you cannot upgrade immediately, either of the following measures prevents exploitation:\n\n * Enable the built-in Content Security Policy by setting\u00a0com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note:\u00a0this protection is only effective on Unblu Spark 7.56.2 or later\u00a0in the 7.x series and 8.19.1 or later\u00a0in the 8.x series, where\u00a0unsafe-inline\u00a0was removed from the script source policy. Earlier versions ship a CSP that still permits\u00a0unsafe-inline\u00a0and are not protected by this workaround.\n * Configure a WAF rule to block requests that carry a malicious payload in the\u00a0redirectOnFailure\u00a0parameter (in particular, values containing a\u00a0javascript:\u00a0scheme or obfuscated variants such as\u00a0java%0ascript:)."
}
],
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-8152",
"datePublished": "2026-07-22T12:21:28.977Z",
"dateReserved": "2026-05-08T08:12:13.325Z",
"dateUpdated": "2026-07-22T18:55:07.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3519 (GCVE-0-2025-3519)
Vulnerability from nvd – Published: 2025-04-22 08:51 – Updated: 2025-04-22 18:55
VLAI
EPSS
VEX
Title
Replace uploaded files knowing the file upload ID
Summary
An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.
Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 18:55 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
8.13.1
(semver)
Affected: 8.0.0 , ≤ 8.12.1 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:55:22.227888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:55:44.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authorization bypass\u0026nbsp;in\u0026nbsp;Unblu Spark allows a\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eparticipant of a conversation\u0026nbsp;\u003c/span\u003eto replace an existing, uploaded file.\u003cbr\u003e\u003cbr\u003eEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly. \u003cbr\u003e"
}
],
"value": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:41.681Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"
}
],
"source": {
"advisory": "UBL-2025-001",
"discovery": "EXTERNAL"
},
"title": "Replace uploaded files knowing the file upload ID",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3519",
"datePublished": "2025-04-22T08:51:41.681Z",
"dateReserved": "2025-04-11T14:18:18.443Z",
"dateUpdated": "2025-04-22T18:55:44.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3518 (GCVE-0-2025-3518)
Vulnerability from nvd – Published: 2025-04-22 08:49 – Updated: 2025-04-24 14:59
VLAI
EPSS
VEX
Title
File upload functionality possible even when disabled
Summary
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.
The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.
If file sharing is generally enabled, this issue is not of concern.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 18:57 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
7.54.1
(semver)
Unaffected: 8.13.1 (semver) Affected: 7.0.0 , ≤ 7.53.4 (semver) Affected: 8.0.0 , ≤ 8.12.1 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:57:26.161061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-24T14:59:31.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "7.54.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.53.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\u003cbr\u003e\u003cbr\u003eThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\u003cbr\u003e\u003cbr\u003eIf file sharing is generally enabled, this issue is not of concern. \u003cbr\u003e \u003cbr\u003e"
}
],
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\n\nThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\n\nIf file sharing is generally enabled, this issue is not of concern."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:07.759Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-002"
}
],
"source": {
"advisory": "UBL-2025-002",
"discovery": "EXTERNAL"
},
"title": "File upload functionality possible even when disabled",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3518",
"datePublished": "2025-04-22T08:49:56.073Z",
"dateReserved": "2025-04-11T14:18:16.805Z",
"dateUpdated": "2025-04-24T14:59:31.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-14933 (GCVE-0-2026-14933)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:08 – Updated: 2026-10-20 15:28
VLAI
EPSS
VEX
Title
Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
Summary
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.
The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.
Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
8.35.2-hotfix.0 , < 8.35.2
(semver)
Unaffected: 8.37.2-hotfix.2 , < 8.37.2 (semver) Unaffected: 8.38.2-hotfix.0 , < 8.38.2 (semver) Affected: 7.0 , ≤ 7.57.7 (semver) Affected: 8.0 , ≤ 8.39.2 (semver) Unaffected: 8.39.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:28:00.378931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:28:15.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThan": "8.35.2",
"status": "unaffected",
"version": "8.35.2-hotfix.0",
"versionType": "semver"
},
{
"lessThan": "8.37.2",
"status": "unaffected",
"version": "8.37.2-hotfix.2",
"versionType": "semver"
},
{
"lessThan": "8.38.2",
"status": "unaffected",
"version": "8.38.2-hotfix.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.57.7",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.39.2",
"status": "affected",
"version": "8.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.39.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\u003c/p\u003e\u003cp\u003eThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\u003c/p\u003e\u003cp\u003eExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected.\u003c/p\u003e"
}
],
"value": "Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\n\n\n\nThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\n\n\n\nExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:08:43.830Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-004"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin.\u003c/p\u003e"
}
],
"value": "Upgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\n\n\n\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\n\n\n\nFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin."
}
],
"source": {
"advisory": "UBL-2026-004",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Cross-Site Scripting in Embedded Co-Browsing",
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-14933",
"datePublished": "2026-10-20T11:08:43.830Z",
"dateReserved": "2026-07-07T10:56:24.163Z",
"dateUpdated": "2026-10-20T15:28:15.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9589 (GCVE-0-2026-9589)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:01 – Updated: 2026-10-20 15:36
VLAI
EPSS
VEX
Title
Unblu Spark Authorization Bypass in Configuration Cascade Operations
Summary
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.
The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.
Exploitation requires an authenticated session but no user interaction.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:35 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Affected:
7.0 , < 8.37.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:35:28.675324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:36:00.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThan": "8.37.0",
"status": "affected",
"version": "7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren\u0027t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers\u0027 accounts, via configuration read and write operations that target those entities.\u003c/p\u003e\u003cp\u003eThe Collaboration Server doesn\u0027t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren\u0027t allowed to edit, in any scope.\u003c/p\u003e\u003cp\u003eExploitation requires an authenticated session but no user interaction.\u003c/p\u003e"
}
],
"value": "Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren\u0027t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers\u0027 accounts, via configuration read and write operations that target those entities.\n\n\n\nThe Collaboration Server doesn\u0027t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren\u0027t allowed to edit, in any scope.\n\n\n\nExploitation requires an authenticated session but no user interaction."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Unblu Cloud"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:01:14.409Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-002"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Unblu Spark 8.37.2 or later. There is no fix for Unblu Spark 7.x.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eThere is no workaround for on-premises deployments.\u003c/p\u003e"
}
],
"value": "Upgrade to Unblu Spark 8.37.2 or later. There is no fix for Unblu Spark 7.x.\n\n\n\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\n\n\n\nThere is no workaround for on-premises deployments."
}
],
"source": {
"advisory": "UBL-2026-002",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Authorization Bypass in Configuration Cascade Operations",
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-9589",
"datePublished": "2026-10-20T11:01:14.409Z",
"dateReserved": "2026-05-26T13:09:34.301Z",
"dateUpdated": "2026-10-20T15:36:00.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8152 (GCVE-0-2026-8152)
Vulnerability from cvelistv5 – Published: 2026-07-22 12:21 – Updated: 2026-07-22 18:55
VLAI
EPSS
VEX
Title
Unblu Spark Open Redirect leading to DOM-Based XSS
Summary
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-22 18:54 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Affected:
0 , ≤ 8.36.1
(semver)
Unaffected: 8.36.1-hotfix.0 (semver) Unaffected: 8.37.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:54:56.321413Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:55:07.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThanOrEqual": "8.36.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.36.1-hotfix.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.37.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eUnblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eWhen Unblu Spark is deployed with \u003ccode\u003ecom.unblu.identifier.siteEmbeddedSetup=true\u003c/code\u003e, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 \u2014 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment (same site)"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Cloud deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T12:21:28.977Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIn the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (\u003ccode\u003edocument.location.origin\u003c/code\u003e).\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\n\n\nAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin)."
}
],
"source": {
"advisory": "UBL-2026-001",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Open Redirect leading to DOM-Based XSS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIf you cannot upgrade immediately, either of the following measures prevents exploitation:\u003c/div\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003eEnable the built-in Content Security Policy by setting\u0026nbsp;\u003ccode\u003ecom.unblu.contentsecuritypolicy.mode=on\u003c/code\u003e. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. \u003cb\u003eNote:\u003c/b\u003e\u0026nbsp;this protection is only effective on Unblu Spark \u003cb\u003e7.56.2 or later\u003c/b\u003e\u0026nbsp;in the 7.x series and \u003cb\u003e8.19.1 or later\u003c/b\u003e\u0026nbsp;in the 8.x series, where\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;was removed from the script source policy. Earlier versions ship a CSP that still permits\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;and are not protected by this workaround.\u003c/li\u003e\u003cli\u003eConfigure a WAF rule to block requests that carry a malicious payload in the\u0026nbsp;\u003ccode\u003eredirectOnFailure\u003c/code\u003e\u0026nbsp;parameter (in particular, values containing a\u0026nbsp;\u003ccode\u003ejavascript:\u003c/code\u003e\u0026nbsp;scheme or obfuscated variants such as\u0026nbsp;\u003ccode\u003ejava%0ascript:\u003c/code\u003e).\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "If you cannot upgrade immediately, either of the following measures prevents exploitation:\n\n * Enable the built-in Content Security Policy by setting\u00a0com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note:\u00a0this protection is only effective on Unblu Spark 7.56.2 or later\u00a0in the 7.x series and 8.19.1 or later\u00a0in the 8.x series, where\u00a0unsafe-inline\u00a0was removed from the script source policy. Earlier versions ship a CSP that still permits\u00a0unsafe-inline\u00a0and are not protected by this workaround.\n * Configure a WAF rule to block requests that carry a malicious payload in the\u00a0redirectOnFailure\u00a0parameter (in particular, values containing a\u00a0javascript:\u00a0scheme or obfuscated variants such as\u00a0java%0ascript:)."
}
],
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-8152",
"datePublished": "2026-07-22T12:21:28.977Z",
"dateReserved": "2026-05-08T08:12:13.325Z",
"dateUpdated": "2026-07-22T18:55:07.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3519 (GCVE-0-2025-3519)
Vulnerability from cvelistv5 – Published: 2025-04-22 08:51 – Updated: 2025-04-22 18:55
VLAI
EPSS
VEX
Title
Replace uploaded files knowing the file upload ID
Summary
An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.
Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 18:55 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
8.13.1
(semver)
Affected: 8.0.0 , ≤ 8.12.1 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:55:22.227888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:55:44.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authorization bypass\u0026nbsp;in\u0026nbsp;Unblu Spark allows a\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eparticipant of a conversation\u0026nbsp;\u003c/span\u003eto replace an existing, uploaded file.\u003cbr\u003e\u003cbr\u003eEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly. \u003cbr\u003e"
}
],
"value": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:41.681Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"
}
],
"source": {
"advisory": "UBL-2025-001",
"discovery": "EXTERNAL"
},
"title": "Replace uploaded files knowing the file upload ID",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3519",
"datePublished": "2025-04-22T08:51:41.681Z",
"dateReserved": "2025-04-11T14:18:18.443Z",
"dateUpdated": "2025-04-22T18:55:44.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3518 (GCVE-0-2025-3518)
Vulnerability from cvelistv5 – Published: 2025-04-22 08:49 – Updated: 2025-04-24 14:59
VLAI
EPSS
VEX
Title
File upload functionality possible even when disabled
Summary
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.
The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.
If file sharing is generally enabled, this issue is not of concern.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 18:57 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
7.54.1
(semver)
Unaffected: 8.13.1 (semver) Affected: 7.0.0 , ≤ 7.53.4 (semver) Affected: 8.0.0 , ≤ 8.12.1 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:57:26.161061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-24T14:59:31.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "7.54.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.53.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\u003cbr\u003e\u003cbr\u003eThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\u003cbr\u003e\u003cbr\u003eIf file sharing is generally enabled, this issue is not of concern. \u003cbr\u003e \u003cbr\u003e"
}
],
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\n\nThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\n\nIf file sharing is generally enabled, this issue is not of concern."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:07.759Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-002"
}
],
"source": {
"advisory": "UBL-2025-002",
"discovery": "EXTERNAL"
},
"title": "File upload functionality possible even when disabled",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3518",
"datePublished": "2025-04-22T08:49:56.073Z",
"dateReserved": "2025-04-11T14:18:16.805Z",
"dateUpdated": "2025-04-24T14:59:31.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}