The flaw resides in the Raindrop.io Bookmark Manager Web App version 5.6.76.0. Because the server fails to validate the Chrome extension identifier supplied in a request, a forged identifier can be used to retrieve bookmark data that should be restricted to authenticated users. This weakness corresponds to CWE-20 and CWE-284, allowing improper input validation and access control that can expose private bookmark information.

Only the Raindrop.io Bookmark Manager Web App version 5.6.76.0 is explicitly named in the CVE record; no other vendors or products are listed.

The CVSS score of 6.5 indicates moderate severity and the EPSS score of <1% suggests a very low probability of exploitation. The likely attack vector is a crafted HTTP request that includes a forged Chrome extension identifier. Based on the description, it is inferred that an attacker could trigger this by directing a user’s browser or a malicious extension to send the request, as the server does not verify the identifier. Although the vulnerability is not listed in the CISA KEV catalog, the potential to expose private bookmark data warrants proactive mitigation.