CVE-2026-15594
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability was found in waooAI waoowaoo up to version 0.4.1 in the stablePublicIdFromStorageKey function of the Media Handler component. Manipulation of the storageKey argument leads to improper authorization, enabling a remote attack with high complexity. The exploit is public and the project has not responded.
Risk Assessment
The organization faces the risk of unauthorized access to media resources via remote attack, potentially leading to data leakage or system integrity compromise.
Recommendation
Immediately update waooAI waoowaoo to a version above 0.4.1 if available, or apply a temporary workaround such as validating the storageKey argument.
Original NVD description (English source)
A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.