CVE-2026-82811

MediumCVSS 5.4/10Last modified Nov 11, 2026

Description

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension up to 4.11.21. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.22 mitigates this issue. Upgrading the affected component is advised. The vendor confirms, that "[i]t was fixed in 4.11.21 on Chrome and 4.11.22 on Firefox."

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-345CWE-346

Affected software

VendorProductVersions
Toggl OÜToggl Track Extension4.11.16

References

Timeline

Published
Aug 31, 2026
Last modified
Nov 11, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-828135.4A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetTokenCVE-2026-828148.8The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 CVE-2026-828157.3A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component MiddlewaCVE-2026-828166.3A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/aiCVE-2026-828176.3A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the comCVE-2026-828186.3A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the compoCVE-2026-828197.1A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. ByCVE-2026-828204.3A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String CVE-2026-828214.3A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of the file src/amf.c oCVE-2026-828249.8Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, moCVE-2026-828259.8Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticatCVE-2026-828267.5Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attack