CVE-2026-102630
MediumCVSS 4.7Summary
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
Risk Assessment
An unauthenticated attacker can inject malicious JavaScript into administrator sessions, leading to account takeover and full application compromise. Caching by shared proxies amplifies the attack to multiple administrators.
Recommendation
Update UnoPim to version 2.0.1, 2.1.1, or later. Configure the proxy server not to trust the X-Forwarded-Host header from unknown clients, and clear the proxy cache.
Other vulnerabilities in UnoPim
See all- CVE-2026-85395High
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
- CVE-2026-82524High
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary OS commands on the server.
Original NVD description (English source)
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS