Description
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Published: 2026-10-13
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Immediate Upgrade
AI Analysis

Impact

A flaw in the exportData endpoint of HBAI-Ltd Toonflow-app allows local attackers to manipulate the endpoint and retrieve sensitive data. The vulnerability is a classic information exposure (CWE-200) combined with improper access control (CWE-284). Because the attack requires local execution, it primarily threatens systems that are already compromised or have physical access. Publicly available proof-of-concept code is on hand, meaning the window for exploitation is open until a fix is applied.

Affected Systems

The affected product is HBAI-Ltd Toonflow-app, versions up to and including 1.1.8. The vendor’s release notes state that the code paths referenced in the report are absent from version 2.0.0 and newer, with the current supported release being 2.0.4. Thus only 1.1.8 and older are vulnerable.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Because the attack vector is local, the potential impact is limited to attackers who already have access to the host. Nonetheless, an exploited exportData endpoint could expose a range of data, making the moderate CVSS score a realistic reflection of its risk. Prompt remediation is recommended.

Generated by OpenCVE AI on October 13, 2026 at 16:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Toonflow-app to version 2.0.0 or later (2.0.4 is the current release).
  • Enforce authentication and proper access control on the exportData endpoint, removing any open or unauthenticated routes.
  • If an immediate upgrade is not possible, block local network access to the exportData endpoint through firewall rules or network segmentation so that only authorized users can reach it.

Generated by OpenCVE AI on October 13, 2026 at 16:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Title HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
First Time appeared Hbai-ltd
Hbai-ltd toonflow-app
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:hbai-ltd:toonflow-app:*:*:*:*:*:*:*:*
Vendors & Products Hbai-ltd
Hbai-ltd toonflow-app
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hbai-ltd Toonflow-app
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T15:30:12.762Z

Reserved: 2026-10-12T19:08:28.767Z

Link: CVE-2026-109526

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T16:17:18.277

Modified: 2026-10-13T16:17:18.277

Link: CVE-2026-109526

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T16:45:19Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control