The Glances XML‑RPC server contains a CORS origin list that is intended to restrict browser access to a set of origins. However, the implementation silently falls back to Access‑Control‑Allow‑Origin: * whenever multiple origins are configured. As a result, an attacker can load a malicious web page from any origin and issue a CORS simple request to the /RPC2 endpoint, reading the full system monitoring data without the victim’s knowledge. This leads to remote information disclosure of sensitive system metrics. The weakness is related to improper handling of HTTP header values (CWE‑183) and exposure of data to other origins (CWE‑942).

The vulnerability affects the Glances monitoring tool produced by nicolargo. Any version earlier than 4.5.5 is vulnerable, including 4.5.0 through 4.5.4. The XML‑RPC server must be running with a multi‑origin configuration to trigger the fallback.

The CVSS score of 7.4 indicates a high severity. EPSS is not reported, so the known exploitation probability remains uncertain, though the lack of KEV listing suggests no major public exploitation yet. The typical attack requires only a browser running on the victim system; an attacker can simply serve a malicious page from any domain and send a CORS request to /RPC2. Because the system responds with a wildcard origin, the browser accepts the response, providing the attacker with full monitoring data.