CVE-2026-15332 | A security flaw has been discovered in zhayujie CowAgent up … | CVSS 6.3 MEDIUM

Description

A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the file channel/channel.py of the component Message Endpoint. The manipulation results in missing authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metadata

CVE ID: CVE-2026-15332
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-09 18:37 UTC
Published: 2026-07-10 04:45 UTC
Last updated: 2026-07-10 04:45 UTC
Primary CWE: CWE-862
Missing Authorization
Vendor / Product: zhayujie / CowAgent
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
zhayujie	CowAgent	—	2.0, 2.1.0

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	Missing Authorization
CWE-863	cna	Incorrect Authorization

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-377275 | zhayujie CowAgent Message Endpoint channel.py authorization https://vuldb.com/vuln/377275
VDB-377275 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/377275/cti
CVE-2026-15332 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-15332
Submit #853105 | zhayujie CowAgent <= 2.1.0 Missing Authorization (CWE-862) https://vuldb.com/submit/853105
https://github.com/zhayujie/CowAgent/issues/2874
https://github.com/zhayujie/CowAgent/