← All CVEs
CVE-2026-49447
Medium · CVSS 5.3Published 2026-07-28
CVSS
5.3
EPSS
—
Exploited
No
Summary
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
References
- https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf
- https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19
- https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5
Is your stack affected?
Pentevo's AI pentest continuously checks your systems against known vulnerabilities like this one.
Recent CVEs
- CVE-2026-65441Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.7.1
- CVE-2026-65442Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.7.2
- CVE-2026-65443Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.7.1
- CVE-2026-65445Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.6.5
- CVE-2026-65446Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.7.1
- CVE-2026-65447Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.7.1