CVE-2026-97155 Overview
CVE-2026-97155 affects the Fabasoft Folio Client, a locally installed component that communicates with the Fabasoft browser extension through web messaging. The client fails to restrict which web origins may invoke its functions by default. The VALIDDOMAINS registry value, which would limit permitted origins, is optional and empty in default installations. As a result, any website visited by a user with the Folio Client and browser extension installed can invoke client functions. These functions include downloading documents, opening documents, and synchronizing files. The vulnerability is tracked under CWE-346: Origin Validation Error.
Critical Impact
Any attacker-controlled website visited by a user with the vulnerable client installed can trigger file download, open, and synchronization operations without additional authentication.
Affected Products
- Fabasoft Folio Client versions before 2026 (fixed in Build 26.0.0.10)
- Fabasoft Folio Client 2026 April Release before Build 26.4.0.76
- Fabasoft eGov-Suite (ships with the affected client)
Discovery Timeline
- 2026-09-24 - CVE-2026-97155 published to NVD
- 2026-09-26 - Last updated in NVD database
Technical Details for CVE-2026-97155
Vulnerability Analysis
The Fabasoft Folio Client exposes a web messaging interface used by the companion browser extension to invoke local client functions. These functions perform privileged actions on behalf of the user, including document retrieval, document opening, and file synchronization against configured Fabasoft servers.
The client relies on the VALIDDOMAINS registry value to constrain which web origins can call into this interface. Because this value is optional and empty by default, every origin is implicitly trusted. Attacker-controlled web content loaded in the user's browser can issue messages that the client processes as if they came from a legitimate Fabasoft web application.
Exploitation requires user interaction, as the victim must visit the attacker's web page while the Folio Client and browser extension are installed. No authentication to the attacker site is required, and the attack succeeds over the network.
Root Cause
The root cause is missing origin validation in the inter-process communication path between the browser extension and the local client. Trust is governed by a configuration value that administrators must populate manually, and the default empty state is interpreted as allow-all rather than deny-all.
Attack Vector
An attacker hosts a web page containing script that targets the Fabasoft browser extension's messaging channel. When a user with the vulnerable configuration visits the page, the script issues function calls to the local client. The client executes requests such as document downloads, document opens, and file synchronizations against the user's Fabasoft environment, enabling tampering with user documents and local file state.
No verified public exploit code is available. Refer to the Fabasoft Folio Client Security Guide for vendor-authored technical details.
Detection Methods for CVE-2026-97155
Indicators of Compromise
- Unexpected invocations of the Fabasoft Folio Client originating from browser processes while users are browsing non-Fabasoft web content.
- Unexpected file writes or synchronizations into Fabasoft-managed local directories outside of normal user workflows.
- Presence of the Folio Client with an absent or empty VALIDDOMAINS registry value on endpoints running affected builds.
Detection Strategies
- Audit affected endpoints for the Folio Client version and the state of the VALIDDOMAINS registry value, flagging hosts running builds prior to 26.0.0.10 or 26.4.0.76.
- Correlate browser process activity with Folio Client invocations to identify messaging calls initiated outside approved Fabasoft web origins.
- Monitor for anomalous document download or synchronization events tied to user browsing sessions.
Monitoring Recommendations
- Collect endpoint telemetry for process launches and file writes performed by the Folio Client, including parent process context.
- Log changes to the VALIDDOMAINS registry value to detect regression or tampering after remediation.
- Alert on Folio Client activity triggered during visits to domains not present in the organization's approved Fabasoft origin list.
How to Mitigate CVE-2026-97155
Immediate Actions Required
- Upgrade the Fabasoft Folio Client to Build 26.0.0.10 or Build 26.4.0.76 (April Release) or later on all endpoints.
- Populate the VALIDDOMAINS registry value with the explicit list of trusted Fabasoft web origins used in your environment.
- Inventory endpoints with the Fabasoft browser extension installed and prioritize those running affected builds.
Patch Information
Fabasoft addressed CVE-2026-97155 in Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). Deployments of Fabasoft eGov-Suite that ship the client should be updated to a release containing a fixed build. Vendor guidance is available in the Fabasoft Folio Client Security Guide.
Workarounds
- Configure the VALIDDOMAINS registry value on all endpoints to explicitly list permitted Fabasoft origins until patches are deployed.
- Remove or disable the Fabasoft browser extension on endpoints that do not require it.
- Restrict user browsing on hosts with the Folio Client installed via web proxy policies that block uncategorized or untrusted sites.
# Configuration example: set the VALIDDOMAINS registry value
# Replace the example origins with your organization's approved Fabasoft hosts
reg add "HKLM\Software\Fabasoft\Folio Client" /v VALIDDOMAINS /t REG_MULTI_SZ /d "https://folio.example.com\0https://egov.example.com" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
