Executive brief
Eramba, a governance, risk, and compliance (GRC) platform, contains a security flaw in how it handles web requests from other websites. An attacker could lure a logged-in user to a malicious site, which then silently steals the user's session information and personal data from the Eramba platform. This could lead to unauthorized access to sensitive corporate risk data and full account takeover.
Technical details
A Cross-Origin Resource Sharing (CORS) misconfiguration (CWE-942) exists in Eramba v3.26.0. The application reflects the 'Origin' header from incoming requests in the 'Access-Control-Allow-Origin' response header while simultaneously setting 'Access-Control-Allow-Credentials' to true. This allows a malicious third-party website to perform authenticated API requests (e.g., to /system-api/user/me) via a victim's browser. An attacker can exfiltrate sensitive session data, including user IDs, names, emails, and access groups, enabling full session hijacking. The vulnerability is present in default installations and was addressed in version 3.28.0.
Affected products
- Eramba Eramba Community Edition 3.26.0
- Eramba Eramba Enterprise Edition 3.26.0
Timeline
- 2025-11-21: patched: Version 3.28.0 released with CORS hardening
- 2026-01-13: disclosed: Initial CVE publication