Glances is an open-source system monitoring tool that exposes a REST API at /api/4/* Before version 4.5.4, the web server allows unauthenticated access to this API and implements a permissive CORS policy (Access‑Control‑Allow‑Origin: *) which lets any origin send cross‑origin requests An attacker can use a malicious web page to read sensitive machine data from a Glances instance running on the victim’s browser, allowing cross‑origin data exfiltration The flaw is a confidentiality breach (CWE‑200) that can occur without authentication and primarily leaks system information such as process, network, and CPU statistics

The vulnerability affects all editions of Glances provided by nicolargo. Versions earlier than 4.5.4 are vulnerable; Glances 4.5.4 and later contain the patch that removes the unauthenticated REST endpoints and tightens the CORS policy

The CVSS score of 7.7 indicates a high severity for confidentiality impact. EPSS data is not available, and the vulnerability is not currently listed in CISA KEV. Exfiltration can be performed simply by hosting a malicious page and having a user visit the page while the Glances instance is reachable from the victim's network. Authentication is not required, and the permissive CORS header allows the browser to read the API response, making exploitation straightforward for an active web attacker.