HIGH 8.8 GitHub
CVE-2026-59148
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
## Summary
Mockoon's admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob/4375a8f/packages/commons-server/src/libs/server/admin-api.ts)) is mounted on the same Express listener as the user-defined mock routes, **enabled by default** in every shipped runtime (commons-server, CLI, serverless), serves **`Access-Control-Allow-Origin: *` on every endpoint with all HTTP methods allowed including PUT/POST/PATCH/DELETE/PURGE and `Content-Type` in `Access-Co
Affected Products
- npm/@mockoon/commons-server < 9.7.0
- npm/@mockoon/cli < 9.7.0
References
- https://github.com/advisories/GHSA-rqx4-3f6q-3x2v
- https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v
- https://nvd.nist.gov/vuln/detail/CVE-2026-59148
- https://github.com/mockoon/mockoon/pull/2254
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-09-11 via GitHub. Affected: npm/@mockoon/commons-server < 9.7.0, npm/@mockoon/cli < 9.7.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.