CVE-2026-49447 Details
Description
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
An authorization bypass vulnerability has been identified in Cosmos Home Server version 0.22.18. The issue arises in the `GET /cosmos/api/constellation/public-devices` endpoint, which discloses Constellation device metadata to any requester that includes a non-empty Authorization header. The server strips the 'Bearer' prefix from the header but fails to validate the token or use it in the database query. As a result, the endpoint can be accessed without proper authorization, exposing sensitive device information.
To address this vulnerability, the header check should be replaced with proper authorization validation. The endpoint should require either a valid Cosmos user/API token with appropriate permissions or a dedicated Constellation device/API token that is cryptographically verified and scoped to the devices the caller is allowed to access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf | [email protected] | Source CodeVendor |
| https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19 | [email protected] | Release NotesVendor |
| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Azukaar Cosmos | 0.22.18 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |