{"id":"EUVD-2026-78588","revision":"a44f3f5235dd44a7b4b00a89ae896e48","records":[{"revision":"a44f3f5235dd44a7b4b00a89ae896e48","observedAt":"2026-11-01T09:10:35.053+00:00","statement":{"source":"euvd","id":"EUVD-2026-78588","aliases":["CVE-2026-49446","GHSA-2rx5-2g7j-2659"],"title":"Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunne…","description":"Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.1,"severity":null}],"references":["https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659","https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf","https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78588","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 15, 2026, 2:31:24 PM","dateUpdated":"Sep 15, 2026, 2:50:54 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78588","identifiers":["EUVD-2026-78588","CVE-2026-49446","GHSA-2rx5-2g7j-2659"]},"retained":false,"historicalAffected":[]}],"coverage":[]}