Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme

published 2026-06-14 4mo ago modified 2026-07-24 3mo ago also EUVD-2026-36669

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits: 0; none known

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. The manipulation leads to improper authorization in handler for custom url scheme. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.

Is CVE-2026-12190 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 4mo ago (2026-06-15)

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CNA	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
CNA	3.0	5.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
CNA	2.0	4.3	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	4.3	AV:L/AC:L/Au:S/C:P/I:P/A:P

Affected products

Genspark AI Workspace App

Classification

Weakness

CWE-939 Improper Authorization in Handler for Custom URL Scheme
CWE-285 Improper Authorization

References

vuldb.com /vuln/370836
vdb-entry
vuldb.com /vuln/370836/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-12190
third-party-advisory
vuldb.com /submit/825558
third-party-advisory
github.com /actuator/ai.mainfunc.genspark
related

Sources

CVE List CVE-2026-12190
NVD CVE-2026-12190

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.