Log in Start free

Vulnerability · Published Jun 29, 2026 · Assigned by VulDB

CVE-2026-13534CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization

Medium 5.0

In plain English

A medium-severity authorization bypass via user-controlled key in cherry-studio from CherryHQ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.3%top 74.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/main/services/memory/MemoryService.ts of the component CherryIN Preload API. Performing a manipulation of the argument state results in authorization bypass. The attack can be initiated remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The vendor explains, that "[m]emory is planned to be removed in v2 version."

Affected products (as reported)

VendorProductVersions
CherryHQ cherry-studio 1.9.01.9.11.9.21.9.31.9.41.9.51.9.61.9.7

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References