CVE-2026-109526
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In HBAI-Ltd Toonflow-app up to 1.1.8, an unknown function of the exportData Endpoint component leads to information disclosure. The attack requires local access, and the exploit has been disclosed to the public. Upgrading to version 2.0.0 mitigates this issue. The vendor explains that the report targets version 1.1.8, while the current release 2.0.4 is the result of a substantial architectural refactor and the referenced code paths do not apply.
Risk Assessment
A local attacker could gain access to sensitive information, potentially leading to data leakage. The risk is limited because the attack requires local access and the vendor claims the issue does not affect the current version.
Recommendation
Update HBAI-Ltd Toonflow-app to version 2.0.0 or later, which mitigates the vulnerability. Also verify whether the used version is still supported.
Other vulnerabilities in Toonflow-app
Original NVD description (English source)
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS