CVE-2026-30924 is a critical CORS misconfiguration (CVSS 9.6) in qui, a web interface for qBittorrent, in versions 1.14.1 and below. Any web page can make authenticated requests for a logged in user. The GitHub advisory lists 1.15.0 as the patched version.
What's affected
qui versions 1.14.1 and below are affected. The GitHub advisory lists the Docker package ghcr.io/autobrr/qui as affected before 1.15.0 and patched in 1.15.0 or later.
The record notes the issue was not fixed at the time it was published, so older copies of the record may say no fix exists. The advisory page is the current source.
Exploitation requires that the victim opens qui through a non localhost hostname and then loads an attacker controlled page.
How to check if you're exposed
Find the image tag or binary version you run:
docker ps --format '{{.Names}} {{.Image}}'
Then note how you reach qui in the browser. If you use a hostname or IP address other than localhost, the record says you are in the scenario it describes.
What to do now
- Upgrade qui to 1.15.0 or later.
- Rotate API keys and any credentials stored in qui if the instance was reachable from browsers that also visit untrusted sites.
- Review the External Programs settings, since the record says that feature could lead to full system compromise, and remove entries you do not recognize.
- Keep qui off the public internet and reach it over a VPN.
Why it matters
The weakness class is CWE-942, permissive cross domain policy with untrusted domains. The server echoed back whatever origin made the request and also sent the header that allows credentials. Together these tell a browser to let any site read authenticated responses.
The record says the likeliest real world scenario is a targeted social engineering attack, because the victim has to open a hostile page while signed in. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Does using localhost protect me?
The record says exploitation requires accessing the application through a non localhost hostname. Do not rely on that alone, and upgrade.
What is CORS?
It is the browser rule that decides which sites may read responses from another site. A policy that trusts every origin removes that protection.
Sources
Last reviewed: 19 October 2026.
