Executive brief
Raindrop.io is a popular bookmark management service used to save and organize web content. A security flaw in its web application allows unauthorized access to sensitive user data because the system does not properly verify the identity of browser extensions requesting information. An attacker could exploit this to intercept private user information through specially crafted web requests, potentially compromising user privacy and account data.
Technical details
An improper input validation vulnerability (CWE-20) and improper access control (CWE-284) exist in the Raindrop.io Bookmark Manager Web App version 5.6.76.0. The application fails to sufficiently validate Chrome extension identifiers during cross-origin requests. By crafting a request with a manipulated Origin header or extension ID, an unauthenticated remote attacker can bypass intended restrictions to obtain sensitive user data from the /v1/user endpoint. This is likely related to an overly permissive CORS configuration that trusts arbitrary extension origins. As of the advisory date, users should ensure they are running the latest version of the web application and extension.
Affected products
- Raindrop.io Bookmark Manager Web App 5.6.76.0
Timeline
- 2025-11: disclosed: Vulnerability discovered by Muhammad Shamim
- 2026-04-22: advisory: CVE-2026-31192 published