What is CVE-2026-27579?

CVE-2026-27579 is a high-severity vulnerability in Karnop Realtime-Collaboration-Platform, classified under Origin Validation Error. CVSS score: 7.4/10. Published 2026-02-21.

How severe is CVE-2026-27579?

High severity. CVSS v3 base score is 7.4 out of 10.

Is CVE-2026-27579 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Karnop Realtime-Collaboration-Platform

CVE-2026-27579

CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication.

EPSS: 0.002 (13.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.

Affected products

Karnop Realtime-collaboration-platform — versions <= master

Weakness classification (CWE)

Public proof-of-concept exploits

AdityaBhatt3010/CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-27579?: CVE-2026-27579 is a high-severity vulnerability in Karnop Realtime-Collaboration-Platform, classified under Origin Validation Error. CVSS score: 7.4/10. Published 2026-02-21.
How severe is CVE-2026-27579?: High severity. CVSS v3 base score is 7.4 out of 10.
Is CVE-2026-27579 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.