CVE-2024-8026
CSRF in Qanything ≤ 2024-06-24
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-8026 is a high-severity CSRF (CWE-352) vulnerability in Qanything Qanything. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-8026 is a Cross-Site Request Forgery (CSRF) vulnerability in the backend API of netease-youdao/qanything, present as of commit d9ab8bc. The issue arises from overly permissive CORS headers on the backend server, which allow all cross-origin calls. This affects all backend endpoints, enabling unauthorized actions such as creating, uploading, listing, deleting files, and managing knowledge bases. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) and maps to CWE-352.
An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low complexity (AC:L), but it requires user interaction (UI:R), such as tricking a victim into visiting a malicious site while authenticated to the backend. Exploitation allows the attacker to perform actions on the victim's behalf across all endpoints, resulting in high integrity (I:H) and availability (A:H) impacts, including arbitrary file operations and knowledge base modifications, with no direct confidentiality loss (C:N).
Mitigation guidance is available in the Huntr.com advisory at https://huntr.com/bounties/e57f1e32-0fe5-4997-926c-587461aa6274, where the vulnerability was reported. Security practitioners should consult this reference for patch details or recommended fixes, such as restricting CORS headers.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6914
Vulnerability Data
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating,…
more
uploading, listing, deleting files, and managing knowledge bases.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.