Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/main/services/memory/MemoryService.ts of the component CherryIN Preload API. Performing a manipulation of the argument state results in authorization bypass. The attack can be initiated remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The vendor explains, that "[m]emory is planned to be removed in v2 version."
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-13534 Authorization Bypass in CherryHQ Cherry-Studio Up to 1.9.7 via State Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13534
Post summary
An authorization bypass vulnerability (CVE‑2026‑13534) has been disclosed in CherryHQ Cherry‑Studio up to 1.9.7, allowing state manipulation to bypass authorization checks. No exploitation, PoC, or patch information is provided.