{"id":"EUVD-2026-42683","enisaUuid":"b98f03a5-f359-302c-a867-a6f3d9045b5f","description":"Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon\u0027s admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.","datePublished":"Jul 9, 2026, 6:27:18 PM","dateUpdated":"Jul 9, 2026, 7:24:49 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v\nhttps://github.com/mockoon/mockoon/pull/2254\nhttps://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299\nhttps://github.com/mockoon/mockoon/releases/tag/v9.7.0\nhttps://mockoon.com/releases/9.7.0\n","aliases":"CVE-2026-59148\nGHSA-rqx4-3f6q-3x2v\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"e0f3f323-511b-3f7c-b212-c649cae0db77","product":{"name":"mockoon","vendor":{"name":"mockoon"}},"product_version":"\u003c 9.7.0"}],"enisaIdVendor":[{"id":"d06d8ebd-e452-31e1-a508-17aad6f4a620","vendor":{"name":"mockoon"}}],"enisaIdVulnerability":[{"id":"6dae2b7e-3956-3b77-a023-7e85e1789b35","vulnerability":{"id":"CVE-2026-59148","description":"Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon\u0027s admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.","datePublished":"Jul 9, 2026, 6:27:18 PM","dateUpdated":"Jul 9, 2026, 7:24:49 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v\nhttps://github.com/mockoon/mockoon/pull/2254\nhttps://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299\nhttps://github.com/mockoon/mockoon/releases/tag/v9.7.0\nhttps://mockoon.com/releases/9.7.0\n","enisa_id":"EUVD-2026-42683\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 15, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"534a6dec-0c5e-353c-8711-52716b743848","product":{"name":"mockoon","vendor":{"name":"mockoon"}},"product_version":"\u003c 9.7.0"}],"vulnerabilityVendor":[{"id":"67a9ed7e-2184-39f6-aa4c-086638c294b6","vendor":{"name":"mockoon"}}]}},{"id":"a8d85ba5-5fd5-33b2-b89f-a34d1207bb8b","vulnerability":{"id":"GHSA-rqx4-3f6q-3x2v","description":"@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft","datePublished":"Sep 11, 2026, 10:04:42 PM","dateUpdated":"Sep 11, 2026, 10:04:42 PM","baseScore":0.0,"references":"https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59148\nhttps://github.com/mockoon/mockoon/pull/2254\nhttps://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299\nhttps://github.com/mockoon/mockoon\nhttps://github.com/mockoon/mockoon/releases/tag/v9.7.0\nhttps://mockoon.com/releases/9.7.0\n","enisa_id":"EUVD-2026-42683\n","aliases":"GHSA-rqx4-3f6q-3x2v\nCVE-2026-59148\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:55:30 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}