9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30924

CVE-2026-30924: qui CORS Misconfiguration: Arbitrary Origins Trusted

qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a logged-in user. An attacker can exploit this by tricking a victim into loading a malicious webpage, which silently interacts with the application using the victim's session and potentially exfiltrating sensitive data such as API keys and account credentials, or even achieving full system compromise through the built-in External Programs manager. Exploitation requires that the victim access the application via a non-localhost hostname and load an attacker-controlled webpage, making highly targeted social-engineering attacks the most likely real-world scenario. This issue was not fixed at the time of publication.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30924

CVE-2026-30924:

9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/autobrr/qui	go	<= 1.14.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic CORS misconfiguration where the application was configured to trust arbitrary origins. The analysis of the patch commit 424f7a0de089dce881e8bbecd220163a78e0295f confirms this. The key change is in internal/api/server.go, within the Server.Handler function. The vulnerable code, which was removed, configured the CORS middleware with AllowOriginFunc: func(origin string) bool { return true }. This line explicitly tells the server to allow requests from any origin. Furthermore, AllowCredentials: true was also set, permitting the browser to send cookies and other credentials with these cross-origin requests. This allowed a malicious website to make authenticated API calls as the victim user. The fix replaces this permissive policy with a strict allowlist controlled by the new corsAllowedOrigins configuration option. If the allowlist is empty (the default), the CORS middleware is not used at all, effectively denying all cross-origin requests.

Vulnerable functions

Server.Handler

internal/api/server.go

This function configures the HTTP server's middleware. The vulnerable version used a CORS middleware with `AllowOriginFunc` set to always return `true`, effectively trusting any origin. It also set `AllowCredentials` to `true`. This combination allowed any malicious website to make authenticated requests to the application's API on behalf of a user, leading to sensitive data exfiltration and potential remote code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.