Cleanuparr is a cleanup utility for Sonarr, Radarr, and compatible download clients. The vulnerability occurs because the application’s global CORS policy reflects the "Origin" header and allows credentials, while the API can authenticate requests from trusted IP addresses via a TrustedNetworkAuthenticationHandler when DisableAuthForLocalAddresses is enabled This combination lets any website that an admin or a user on a trusted IP visits read authenticated API responses in a cross‑origin manner, exposing the admin’s permanent API key and other sensitive information.

All Cleanuparr installations running version 2.9.9 or earlier are affected. The product is maintained by the Cleanuparr team.

The CVSS score of 8.0 classifies the issue as a high severity flaw with significant confidentiality impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting moderate to low current exploit prevalence. Exploitation requires a victim admin or trusted‑network user to visit a malicious website that can issue cross‑origin requests; the victim’s browser will automatically attach credentials, enabling the attacker to obtain the admin API key. While the attack vector is not purely local, it relies on user interaction with a malicious site, making the exploit plausible but not trivially automatable.