Read the docs
TI-2026-63951 Aliases CVE-2026-97155GHSA-9hhv-69vm-5vcw

Origin validation error in Fabasoft Folio Client

Priority LOW 28CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00112 1st percentileScored 2026-11-08
Fix Fixed Folio Client (Fabasoft): 2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FabasoftFolio Clientbefore 20262026Patch availableCNA
  • Folio Client VendorFabasoft Affected before 2026 Fixed in 2026 Patch available CNA

Remediation

  • Fix · CNA Folio Client (Fabasoft) Fixed in 2026

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-97155
  2. 2026-10-03 Alias added: GHSA-9hhv-69vm-5vcw

References

Other 1

  • TI-2023-16030 Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator. CVSS 3.1HIGH 7.8
  • TI-2022-12259 The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation. CVSS 3.1HIGH 7.8
  • TI-2014-06286 The Fabasoft Cloud (aka com.fabasoft.android.cmis.folio_cloud) application 3.0.1 for… CVSS 2.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences