CVE-2026-109526 Details
Description
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
A vulnerability allowing information disclosure has been identified in HBAI-Ltd Toonflow-app versions prior to 1.1.8. The issue arises in an unknown function of the exportData endpoint, and exploitation must be conducted locally. The vulnerability has been publicly disclosed and can be exploited. Users are advised to upgrade to version 2.0.0, which addresses this issue. The vendor states that the reported vulnerability does not apply to any supported release.
Users are advised to upgrade to Toonflow-app version 2.0.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.google.com/drive/folders/13MjPi0zInT9Caau_fqD68FQ0z5fH0YsX?usp=sharing | [email protected] | ExploitPartial Content |
| https://github.com/HBAI-Ltd/Toonflow-app/releases/tag/v2.0.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-109526 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/984380 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/417195 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/417195/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HBAI-Ltd Toonflow-app | <= 1.1.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |