CVE-2026-82089 | CyberRota

CyberRota Analysis

AI-Generated

The wallabag application for Android versions up to 2.6.0 is vulnerable to cross-site scripting (XSS) due to the insecure loading of data from the /api/entries endpoint into a WebView. This vulnerability could allow attackers to execute arbitrary scripts in the context of the user’s session, potentially leading to data theft or session hijacking. Developers and security teams managing Android applications should prioritize addressing this issue to protect user data and maintain application integrity.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals

poc

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-82089

Severity

HIGH

CVSS

8.8

EPSS

0.33%

Android

Original NVD Description

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.