CVE-2026-107503

{
  "etk_id": "ETK-2026-2268",
  "cve_id": "CVE-2026-107503",
  "display_id": "CVE-2026-107503",
  "ghsa_id": "GHSA-8767-g5qv-9jcf",
  "euvd_id": "EUVD-2026-94823",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Untrusted environment configuration injection in Ditto Explorer UI",
  "summary": "Ditto Explorer UI versions 3.6.0 through 3.8.13 and 3.9.0 through 3.9.7 accept environment settings from a URL parameter and retain them in browser storage. An attacker who induces a user to open a crafted UI link can redirect authentication or API requests to attacker-controlled services and obtain credentials or tokens; OAuth session takeover requires the targeted UI URL to be registered as an OIDC redirect URI.",
  "mitigation": "Upgrade eclipse/ditto-ui to 3.8.14 or 3.9.8. Clear the browser's stored `ditto-ui-env` data for potentially exposed users, and avoid untrusted links containing the `environmentsURL` parameter until upgrades are complete.",
  "vendor": "eclipse ditto",
  "product": "eclipse/ditto-ui",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.6.0, < 3.8.14"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.8.14"
      ],
      "package_name": "eclipse/ditto-ui",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.9.0, < 3.9.8"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.9.8"
      ],
      "package_name": "eclipse/ditto-ui",
      "purl": null
    }
  ],
  "cwes": [
    15
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.992562,
  "t0_at": "2026-10-08T09:32:47.485000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-08T15:18:34+00:00",
      "days": 0.2401217013888889,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T09:32:47.485000+00:00",
      "url": "https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-8767-g5qv-9jcf"
    },
    "trigger_signal": {
      "at": "2026-10-08T09:32:47.485000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T09:32:47.485000+00:00",
      "url": "https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-8767-g5qv-9jcf"
    }
  }
}