Search
Find a vulnerability
Search criteria
1 vulnerability found for VidBee by nexmoe
CVE-2026-123787 (GCVE-0-2026-123787)
Vulnerability from cvelistv5 – Published: 2026-11-06 21:00 – Updated: 2026-11-09 13:25 X_Open Source
VLAI
EPSS
VEX
Title
nexmoe VidBee Local HTTP Service local-api.ts information disclosure
Summary
A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 13:25 UTC
Assigner
VulDB
CNA
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431933 | vdb-entry |
| https://vuldb.com/vuln/431933/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123787 | third-party-advisory |
| https://vuldb.com/submit/1009701 | third-party-advisory |
| https://github.com/nexmoe/VidBee/issues/468 | issue-tracking |
| https://drive.google.com/drive/folders/14oKqKWtHM… | exploit |
| https://github.com/nexmoe/VidBee/commit/141b8d39c… | patch |
| https://github.com/nexmoe/VidBee/releases/tag/v2.2.0 | patch |
| https://github.com/nexmoe/VidBee/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nexmoe | VidBee |
Affected:
1.3.0
Affected: 1.3.1 Affected: 1.3.2 Affected: 1.3.3 Affected: 1.3.4 Affected: 1.3.5 Affected: 1.3.6 Affected: 1.3.7 Affected: 1.3.8 Affected: 1.3.9 Affected: 1.3.10 Affected: 1.3.11 Affected: 1.3.12 Affected: 1.3.13 Affected: 2.0.0 Affected: 2.0.1 Affected: 2.0.2 Unaffected: 2.2.0 cpe:2.3:a:nexmoe:vidbee:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123787",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T13:25:11.442368Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:25:23.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nexmoe:vidbee:*:*:*:*:*:*:*:*"
],
"modules": [
"Local HTTP Service"
],
"product": "VidBee",
"vendor": "nexmoe",
"versions": [
{
"status": "affected",
"version": "1.3.0"
},
{
"status": "affected",
"version": "1.3.1"
},
{
"status": "affected",
"version": "1.3.2"
},
{
"status": "affected",
"version": "1.3.3"
},
{
"status": "affected",
"version": "1.3.4"
},
{
"status": "affected",
"version": "1.3.5"
},
{
"status": "affected",
"version": "1.3.6"
},
{
"status": "affected",
"version": "1.3.7"
},
{
"status": "affected",
"version": "1.3.8"
},
{
"status": "affected",
"version": "1.3.9"
},
{
"status": "affected",
"version": "1.3.10"
},
{
"status": "affected",
"version": "1.3.11"
},
{
"status": "affected",
"version": "1.3.12"
},
{
"status": "affected",
"version": "1.3.13"
},
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Notwo1f"
},
{
"lang": "en",
"type": "reporter",
"value": "researchersongwu (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "researchersongwu (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:00:26.229Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431933 | nexmoe VidBee Local HTTP Service local-api.ts information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/431933"
},
{
"name": "VDB-431933 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431933/cti"
},
{
"name": "CVE-2026-123787 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123787"
},
{
"name": "Submit #1009701 | nexmoe VidBee 2.0.2 unauthentication lead to sensitive information leakage,operation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009701"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nexmoe/VidBee/issues/468"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/drive/folders/14oKqKWtHM7oCUMEDYidrp1ETGk0hWKTh"
},
{
"tags": [
"patch"
],
"url": "https://github.com/nexmoe/VidBee/commit/141b8d39c1c11da4589264f814cee077df81e7f6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/nexmoe/VidBee/releases/tag/v2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/nexmoe/VidBee/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-06T18:05:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "nexmoe VidBee Local HTTP Service local-api.ts information disclosure",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123787",
"datePublished": "2026-11-06T21:00:26.229Z",
"dateReserved": "2026-11-06T14:44:08.210Z",
"dateUpdated": "2026-11-09T13:25:23.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}