CVE-2026-109526

LOW 3.3

HBAI-Ltd Toonflow-app exportData Endpoint information disclosure

CVSS Score

3.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."

CWE	CWE-200 CWE-284
Vendor	hbai-ltd
Product	toonflow-app
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for hbai-ltd toonflow-app

Be the first to know when new low vulnerabilities affecting hbai-ltd toonflow-app are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

HBAI-Ltd / Toonflow-app

1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/417195 vuldb.com: https://vuldb.com/vuln/417195/cti vuldb.com: https://vuldb.com/cve/CVE-2026-109526 vuldb.com: https://vuldb.com/submit/984380 drive.google.com: https://drive.google.com/drive/folders/13MjPi0zInT9Caau_fqD68FQ0z5fH0YsX?usp=sharing github.com: https://github.com/HBAI-Ltd/Toonflow-app/releases/tag/v2.0.0

Credits

🔍 notwolf (VulDB User) VulDB CNA Team