CVE-2026-13534
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk10th percentile — higher than 10% of all known CVEs
Summary
In CherryHQ cherry-studio up to version 1.9.7, a vulnerability was found in the sha256 function of the MemoryService.ts file in the CherryIN Preload API component. Manipulation of the state argument leads to authorization bypass.
Risk Assessment
A remote attack with high complexity could allow an unauthorized user to bypass access controls, potentially compromising data confidentiality or integrity.
Recommendation
Immediately update cherry-studio to version 2.0 or later if available, or apply temporary mitigations restricting access to the CherryIN Preload API.
Original NVD description (English source)
A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/main/services/memory/MemoryService.ts of the component CherryIN Preload API. Performing a manipulation of the argument state results in authorization bypass. The attack can be initiated remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The vendor explains, that "[m]emory is planned to be removed in v2 version."