What is GHSA-7ppm-cm7m-926r?

GHSA-7ppm-cm7m-926r is a security advisory published by GitHub Security Advisories with High severity. The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin...

Which CVE IDs does GHSA-7ppm-cm7m-926r cover?

GHSA-7ppm-cm7m-926r covers the following CVE IDs: CVE-2026-85094. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7ppm-cm7m-926r?

GHSA-7ppm-cm7m-926r has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-7ppm-cm7m-926rHighCVSS 8.8

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin...

Vendor

GitHub Security Advisories

Published

September 4, 2026

Last Modified

September 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-85094 →

📋 Description

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-85094
https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a
https://github.com/advisories/GHSA-7ppm-cm7m-926r