CVE-2026-120503

Description

A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 4.8 / 10
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Effective score: 4.8 / 10 MEDIUM source: CNA overview
CWE(s): CWE-200, CWE-284
Reserved: 2026-11-02
Published: 2026-11-02 20:30 UTC
Last updated: 2026-11-02 20:30 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120503.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-115627

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
EchoHS	GeekezBrowser	`1.0` (affected), `1.1` (affected), `1.2` (affected), `1.3` (affected), `1.4` (affected), `1.5` (affected), `1.6` (affected), `1.7` (affected), `1.7.0` (affected), `1.7.1` (affected), `1.7.2` (affected), `1.8.0` (affected), `1.8.1` (unaffected)	—

Vendor references (8)

References embedded in the original CVE record by the assigning CNA.

VDB-429883 | EchoHS GeekezBrowser Public API status information disclosure vdb-entry
VDB-429883 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-120503 | CVE Analysis and Report third-party-advisory
Submit #1027894 | https://github.com/EchoHS/ GeekezBrowser 1.7.1 Local Sensitive Logic Exposure Leading to broswer track third-party-advisory
https://github.com/EchoHS/GeekezBrowser/issues/60 exploitissue-tracking
https://github.com/EchoHS/GeekezBrowser/commit/9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e patch
https://github.com/EchoHS/GeekezBrowser/releases/tag/v1.8.1 patch
https://github.com/EchoHS/GeekezBrowser/ product

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120503.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:echohs:geekezbrowser:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Public API"
          ],
          "product": "GeekezBrowser",
          "vendor": "EchoHS",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "1.5"
            },
            {
              "status": "affected",
              "version": "1.6"
            },
            {
              "status": "affected",
              "version": "1.7"
            },
            {
              "status": "affected",
              "version": "1.7.0"
            },
            {
              "status": "affected",
              "version": "1.7.1"
            },
            {
              "status": "affected",
              "version": "1.7.2"
            },
            {
              "status": "affected",
              "version": "1.8.0"
            },
            {
              "status": "unaffected",
              "version": "1.8.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "wilson888 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T20:30:18.122Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-429883 | EchoHS GeekezBrowser Public API status information disclosure",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/429883"
        },
        {
          "name": "VDB-429883 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/429883/cti"
        },
        {
          "name": "CVE-2026-120503 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-120503"
        },
        {
          "name": "Submit #1027894 | https://github.com/EchoHS/ GeekezBrowser 1.7.1 Local Sensitive Logic Exposure Leading to broswer track",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1027894"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/EchoHS/GeekezBrowser/issues/60"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/EchoHS/GeekezBrowser/commit/9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/EchoHS/GeekezBrowser/releases/tag/v1.8.1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/EchoHS/GeekezBrowser/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-02T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-02T16:37:35.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "EchoHS GeekezBrowser Public API status information disclosure",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-120503",
    "datePublished": "2026-11-02T20:30:18.122Z",
    "dateReserved": "2026-11-02T15:32:24.364Z",
    "dateUpdated": "2026-11-02T20:30:18.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}