Access Control Flaw in Brave Popup Builder by Brave
CVE-2026-77116
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-77116?
The Brave Popup Builder plugin suffers from a broken access control vulnerability that affects versions up to 0.8.5. This flaw allows any logged-in user, including those with Subscriber or WooCommerce Customer roles, to access popup content by manipulating the post ID in the URL. Such unauthorized access can lead to exposure of sensitive information or unauthorized data manipulation, posing a threat to user privacy and data integrity.
Affected Version(s)
Brave 0 < 0.8.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.