CVE-2026-27579

Published February 21st, 2026

View on NVD ↗

CVSS v3

7.4

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication.

karnop/realtime-collaboration-platform

infinite locus assignment. A full-stack, real-time collaboration platform similar to Google Docs. Built with Next.js 14, Appwrite, and Liveblocks, it allows multiple users to edit documents simultaneously with near-zero latency, manage versions, and share work instantly.

GitHub