Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-97155 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:3.1 LOWVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://help.supportservices.fabasoft.com/index.php?topic=doc/Knowledge-Base/changes-to-fabasoft-folio-client-security-settings.htm	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-346	Origin Validation Error	[email protected]

Affected Products

Product	Versions
Fabasoft Folio Client	26.0.0.10 26.4.0.76
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 26.0.0.10moderate effort Upgrade: 26.4.0.76moderate effort Workaround:low effort Configure the VALIDDOMAINS registry key to limit the DNS domains that the Fabasoft Folio Client can interact with. This can also be done during installation by providing the list of domains via the installer argument "VALIDDOMAINS". For example, to authorize "https://www.example.com/fsc" and "http://www.contoso.com/fsc" on Microsoft Windows, use the following command: msiexec /I FolioClient.msi VALIDDOMAINS=www.example.com:443;www.contoso.com:80.

Product

Versions

Fabasoft Folio Client

26.0.0.10

26.4.0.76

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 26.0.0.10moderate effort
Upgrade: 26.4.0.76moderate effort
Workaround:low effort
Configure the VALIDDOMAINS registry key to limit the DNS domains that the Fabasoft Folio Client can interact with. This can also be done during installation by providing the list of domains via the installer argument "VALIDDOMAINS". For example, to authorize "https://www.example.com/fsc" and "http://www.contoso.com/fsc" on Microsoft Windows, use the following command: msiexec /I FolioClient.msi VALIDDOMAINS=www.example.com:443;www.contoso.com:80.

Change History

1 change record found show changes