Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-109526: Toonflow-app may leak data via exportData endpoint

CVE-2026-109526 · published 5 days ago

Summary

The Toonflow application (versions up to 1.1.8) can expose internal information when its exportData function is accessed locally. This could allow a nearby user to view data that should remain private. Updating the app to version 2.0.0 or later removes the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
hbai-ltd	toonflow-app	1.1.0

Original advisory text

HBAI-Ltd Toonflow-app exportData Endpoint information disclosure

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."

References

https://vuldb.com/cve/CVE-2026-109526 third-party-advisory
https://drive.google.com/drive/folders/13MjPi0zInT9Caau_fqD68FQ0z5fH0YsX?usp=sha... exploit
https://github.com/HBAI-Ltd/Toonflow-app/releases/tag/v2.0.0 patch
https://vuldb.com/submit/984380 third-party-advisory
https://vuldb.com/vuln/417195 vdb-entry
https://vuldb.com/vuln/417195/cti signature permissions-required
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1095... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-109526 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

1.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

CWE-284Improper Access Control

Timeline

Published13 Oct 2026

Updated16 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-109526 · NVD

CVE-2026-109526 · MITRE

CVE-2026-109526 · OSV

Track software like this

Free during beta