cinnyapp cinny up to 4.10.2 Emote download information disclosure

Summaryinfo

A vulnerability was found in cinnyapp cinny up to 4.10.2 and classified as problematic. This vulnerability affects unknown code of the file /_matrix/client/v1/media/download of the component Emote Handler. The manipulation results in information disclosure. This vulnerability was named CVE-2026-42553. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in cinnyapp cinny up to 4.10.2. It has been classified as problematic. Affected is an unknown code of the file /_matrix/client/v1/media/download of the component Emote Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

Cinny is a Matrix client. Prior to 4.10.3, A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for the room containing a malicious emote pack. This is caused by an incorrect fallback in EmojiBoard that uses untrusted pack.meta.avatar (user-controlled) without converting/validating it as an MXC URL, allowing arbitrary HTTP(S) URLs to be used. Also, the service worker attaching the user's Authorization bearer token to all outbound GET requests whose URL contains /_matrix/client/v1/media/download or /_matrix/client/v1/media/thumbnail without verifying the request host matches the configured homeserver origin. An attacker-controlled URL containing those path fragments and permissive CORS will receive the victim's Authorization header (access token). This vulnerability is fixed in 4.10.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-42553 since 04/28/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 4.10.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32612). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• cinnyapp

Name

• cinny

Version

• 4.10.0
• 4.10.1
• 4.10.2

Website

• Product: https://github.com/cinnyapp/cinny/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion