A critical CORS misconfiguration in the Karnop Realtime Collaboration Platform allows unauthenticated attackers to steal sensitive user data through malicious cross-origin requests.

The application is misconfigured to allow arbitrary origins in CORS responses while permitting credentialed requests. This allows an unauthenticated attacker to make requests to the Appwrite project and read sensitive data, including email addresses, account identifiers, and MFA status.

The exposure of user account identifiers and MFA status represents a significant risk to data privacy and account security. Given the CVSS score of 7.4, this vulnerability poses a high risk as it facilitates unauthorized access to sensitive information without requiring prior authentication. A successful exploit could lead to full account takeover or targeted phishing campaigns against the user base.

Immediate Action: Since no official patch is currently available, administrators should restrict CORS origins in the Appwrite project configuration to trusted domains only.

Proactive Monitoring: Review web server and application logs for unusual cross-origin requests or traffic originating from unexpected domains.

Compensating Controls: Implement a strict Content Security Policy (CSP) and ensure the Web Application Firewall (WAF) is configured to block requests with suspicious Origin headers.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

This vulnerability presents a high risk to user data integrity and confidentiality. Because there is no vendor-provided patch at this time, security teams must manually adjust the CORS configuration to disallow arbitrary origins. Immediate hardening of the Appwrite project settings is necessary to prevent unauthorized data exfiltration.