Search
Find a vulnerability
Search criteria
1 vulnerability found for Toggl Track Extension by Toggl OÜ
CVE-2026-82811 (GCVE-0-2026-82811)
Vulnerability from cvelistv5 – Published: 2026-08-31 17:00 – Updated: 2026-11-11 10:16
VLAI
EPSS
VEX
Title
Toggl OÜ Toggl Track Extension postMessage origin validation
Summary
A security vulnerability has been detected in Toggl OÜ Toggl Track Extension up to 4.11.21. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.22 mitigates this issue. Upgrading the affected component is advised. The vendor confirms, that "[i]t was fixed in 4.11.21 on Chrome and 4.11.22 on Firefox."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:47 UTC
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397230 | vdb-entry |
| https://vuldb.com/vuln/397230/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82811 | third-party-advisory |
| https://vuldb.com/submit/875273 | third-party-advisory |
| https://github.com/xryj920/chrome_extensions/blob… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Toggl OÜ | Toggl Track Extension |
Affected:
4.11.0
Affected: 4.11.1 Affected: 4.11.2 Affected: 4.11.3 Affected: 4.11.4 Affected: 4.11.5 Affected: 4.11.6 Affected: 4.11.7 Affected: 4.11.8 Affected: 4.11.9 Affected: 4.11.10 Affected: 4.11.11 Affected: 4.11.12 Affected: 4.11.13 Affected: 4.11.14 Affected: 4.11.15 Affected: 4.11.16 Affected: 4.11.17 Affected: 4.11.18 Affected: 4.11.19 Affected: 4.11.20 Affected: 4.11.21 Unaffected: 4.11.22 cpe:2.3:a:toggl_o_:toggl_track_extension:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82811",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:47:13.671688Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:47:25.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:toggl_o_:toggl_track_extension:*:*:*:*:*:*:*:*"
],
"modules": [
"postMessage Handler"
],
"product": "Toggl Track Extension",
"vendor": "Toggl O\u00dc",
"versions": [
{
"status": "affected",
"version": "4.11.0"
},
{
"status": "affected",
"version": "4.11.1"
},
{
"status": "affected",
"version": "4.11.2"
},
{
"status": "affected",
"version": "4.11.3"
},
{
"status": "affected",
"version": "4.11.4"
},
{
"status": "affected",
"version": "4.11.5"
},
{
"status": "affected",
"version": "4.11.6"
},
{
"status": "affected",
"version": "4.11.7"
},
{
"status": "affected",
"version": "4.11.8"
},
{
"status": "affected",
"version": "4.11.9"
},
{
"status": "affected",
"version": "4.11.10"
},
{
"status": "affected",
"version": "4.11.11"
},
{
"status": "affected",
"version": "4.11.12"
},
{
"status": "affected",
"version": "4.11.13"
},
{
"status": "affected",
"version": "4.11.14"
},
{
"status": "affected",
"version": "4.11.15"
},
{
"status": "affected",
"version": "4.11.16"
},
{
"status": "affected",
"version": "4.11.17"
},
{
"status": "affected",
"version": "4.11.18"
},
{
"status": "affected",
"version": "4.11.19"
},
{
"status": "affected",
"version": "4.11.20"
},
{
"status": "affected",
"version": "4.11.21"
},
{
"status": "unaffected",
"version": "4.11.22"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "DRXYJ (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Toggl O\u00dc Toggl Track Extension up to 4.11.21. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.22 mitigates this issue. Upgrading the affected component is advised. The vendor confirms, that \"[i]t was fixed in 4.11.21 on Chrome and 4.11.22 on Firefox.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T10:16:32.775Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397230 | Toggl O\u00dc Toggl Track Extension postMessage origin validation",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/397230"
},
{
"name": "VDB-397230 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397230/cti"
},
{
"name": "CVE-2026-82811 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82811"
},
{
"name": "Submit #875273 | Toggl O\u00dc Toggl Track 4.11.16 Origin Validation Error",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/875273"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/xryj920/chrome_extensions/blob/main/Toggl%20O%C3%9C%20Toggl%20Track%204.11.16%20accepts%20forged%20session-state%20messages%20through%20an%20unauthenticated%20postMessage%20handler"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-31T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-11T11:21:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "Toggl O\u00dc Toggl Track Extension postMessage origin validation",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82811",
"datePublished": "2026-08-31T17:00:10.617Z",
"dateReserved": "2026-08-31T05:10:03.728Z",
"dateUpdated": "2026-11-11T10:16:32.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}