CVE-2026-114574 Details
Description
A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.
A vulnerability allowing information disclosure has been identified in massCodeIO massCode version 5.10. The issue arises from the local HTTP service, which is exposed on all network interfaces instead of being restricted to the loopback interface. This allows an attacker to send requests to the massCode API and access sensitive data such as notes and code snippets without authentication. The vulnerability is exacerbated by permissive cross-origin resource sharing (CORS) headers, which enable unauthorized websites to read the API responses.
Users are advised to update to massCode version 5.11.0, which addresses this vulnerability by binding the local API to the loopback interface, implementing authentication for API requests, and removing wildcard CORS. Instructions for updating can be found in the massCode repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/massCodeIO/massCode/ | [email protected] | Vendor |
| https://github.com/massCodeIO/massCode/commit/d25d8fa3f5a1e34285c8634f18729650c0c05cda | [email protected] | Source CodeVendor |
| https://github.com/massCodeIO/massCode/issues/966 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/massCodeIO/massCode/pull/912 | [email protected] | Source CodeVendor |
| https://vuldb.com/cve/CVE-2026-114574 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1021288 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/424941 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/424941/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| massCodeIO massCode | 5.10.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |