What is GHSA-mxw2-g58m-hfwm?

GHSA-mxw2-g58m-hfwm is a security advisory published by GitHub Security Advisories with High severity. The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an...

Which CVE IDs does GHSA-mxw2-g58m-hfwm cover?

GHSA-mxw2-g58m-hfwm covers the following CVE IDs: CVE-2026-90860. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mxw2-g58m-hfwm?

GHSA-mxw2-g58m-hfwm has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-mxw2-g58m-hfwmHighCVSS 7.1

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an...

Vendor

GitHub Security Advisories

Published

September 21, 2026

Last Modified

September 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-90860 →

📋 Description

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-90860
https://trust.canva.com?tcuUid=c17214e0-e758-4472-8238-abeb79faff07
https://github.com/advisories/GHSA-mxw2-g58m-hfwm