Glances uses an exact-match check for the CORS origins guard in its REST API, which allows a list that contains the wildcard '*' to be considered a valid match. The result is that the cors_credentials flag remains enabled and authenticated API data is sent to origins that are not explicitly trusted. An attacker who can host a malicious web page can thus obtain sensitive system information after a user visits that page while still authenticated to the Glances REST API. This flaw falls under the category of improper authorization checks (CWE‑942).

nicolargo Glances versions earlier than 4.5.6 are affected. Upgrade to 4.5.6 or later to apply the fix.

The vulnerability has a CVSS score of 6.5, indicating moderate severity, while the EPSS score is not available. The issue is not listed in the CISA KEV catalog. From the description, the most likely attack vector is a user visiting a malicious web page that exploits the bypassed CORS credentials guard; the exploit requires the victim to be logged in to Glances. Because the flaw allows credential leakage, the potential impact is data exposure, but the lack of an active public exploit reduces the current threat, though the possibility remains high if attackers target systems running these vulnerable versions.