Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-123208: noname desktop app (v1.11.2‑v1.11.6.1) lets web pages modify local files

CVE-2026-123208 · published 1 day ago

Summary

The noname application for Windows includes a hidden web server that runs on the computer without requiring any login. Because the server accepts requests from any website, a malicious site could tell it to change or delete files that belong to the app, including code that runs with the same rights as the logged‑in user. Update to a newer version or apply the vendor’s patch to disable the local server and restrict file access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
libnoname	noname	<= v1.11.6.1

Original advisory text

noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

References

https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fed... Third Party Advisory
https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fed... Third Party Advisory
https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3... Patch
https://github.com/libnoname/noname/issues/4524 Third Party Advisory
https://github.com/libnoname/noname/pull/4606 Patch
https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-auth... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-1232... Vendor Advisory
https://github.com/libnoname/noname Product
https://nvd.nist.gov/vuln/detail/CVE-2026-123208 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published5 Nov 2026

Updated6 Nov 2026

First seen5 Nov 2026

Sources

CVE-2026-123208 · NVD

CVE-2026-123208 · MITRE

CVE-2026-123208 · OSV

Track software like this

Free during beta