A critical CORS misconfiguration in Rybbit versions prior to 2.7.0 allows unauthenticated attackers to perform unauthorized credentialed actions on behalf of victim users.

The application utilizes an overly permissive Cross-Origin Resource Sharing (CORS) policy that reflects the request origin in the Access-Control-Allow-Origin header while credentials are enabled. This allows an attacker to trick a logged-in user into sending authenticated requests to the Rybbit API from a malicious site, effectively bypassing same-origin protections.

Successful exploitation allows an attacker to perform unauthorized state-changing operations and access sensitive information, including analytics data and account details, as the victim user. Given the CVSS score of 8.1, this vulnerability presents a significant risk to data confidentiality and integrity, potentially leading to widespread account compromise or unauthorized modification of organizational analytics configurations.

Immediate Action: Update the Rybbit installation to version 2.7.0 or later to implement a secure CORS policy that restricts allowed origins.

Proactive Monitoring: Review application access logs for unusual patterns of cross-origin requests, specifically looking for requests originating from unexpected or untrusted domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to enforce strict CORS policies and block requests that contain suspicious Access-Control-Allow-Origin headers if an immediate update is not feasible.

Public Exploit Available: No

The severity of this vulnerability is high, as it enables unauthorized access to authenticated user sessions. Organizations currently running versions of Rybbit older than 2.7.0 should prioritize the update process immediately to prevent potential exploitation. If patching is delayed, ensure that the application is not accessible from untrusted networks where malicious actors might inject cross-origin requests.