CVE-2026-13534: Authorization Bypass in CherryHQ cherry-studio Memory Service

Technical summary

CVE-2026-13534 affects the sha256 function within src/main/services/memory/MemoryService.ts in cherry-studio up to version 1.9.7. The CherryIN Preload API fails to properly validate the state argument, allowing manipulation that circumvents authorization checks tied to CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). Network-accessible, though exploitation requires an authenticated session (PR:L) and high attack complexity (AC:H). The vulnerability results in confidentiality, integrity, and availability impacts within the security context of the affected user.

Business impact

Compromise of cherry-studio deployments enables unauthorized data access and potential lateral privilege escalation within environments relying on the memory service for session or state management. Since the vendor has indicated memory functionality will be removed in version 2, organizations should treat this as a transitional risk requiring immediate attention before deprecation timelines are announced. Exposure is likely limited to organizations using CherryHQ's development or studio tooling.

Affected systems

CherryHQ cherry-studio versions 1.9.7 and earlier are vulnerable. The CherryIN Preload API is the attack surface. Systems must be running an affected version and expose the memory service to an authenticated user—either through direct network access or local system compromise. Verify your deployed version against vendor release notes.

Exploitability

Public exploit code is available, but successful exploitation requires high attack complexity and prior authentication (login credentials or valid session). An attacker must understand the state parameter structure and crafting to bypass authorization logic. While the bar is higher than a simple unauthenticated remote code execution, the combination of public exploit code and known attack pattern makes this a practical concern for security teams managing cherry-studio instances in shared or adversarial environments.

Remediation

Upgrade cherry-studio to a version beyond 1.9.7 as soon as a patched release is available. Consult CherryHQ's official advisory for patch availability and version recommendations. If immediate patching is not feasible, restrict network access to the CherryIN Preload API and disable memory service features if they are not operationally critical. Monitor for exploitation attempts and audit memory service access logs for anomalies.

Patch guidance

Check CherryHQ's official release notes and security advisories for a patched version addressing CVE-2026-13534. Apply patches during a maintenance window to mitigate authorization bypass risk. Because the vendor plans to remove the memory service in version 2, consider upgrading to that major version as part of a longer-term remediation strategy. Test patches in a staging environment before production deployment to ensure compatibility with your workflow.

Detection guidance

Monitor CherryIN Preload API logs for state parameter manipulation attempts, unusual authorization denials followed by successful access, and rapid state enumeration patterns. Network detection: look for repeated requests to memory service endpoints with varying state values. Endpoint detection: flag process execution or file access anomalies following authenticated sessions to cherry-studio. Correlate authentication logs with memory service access to identify suspicious correlations. Consider deploying Web Application Firewall rules to detect malformed or anomalous state parameters.

Why prioritize this

Although CVSS 5.0 is classified as Medium, the combination of public exploit availability, remote attack vector, and authorization bypass in a development/collaboration tool warrants accelerated attention. Developers and administrators using cherry-studio should treat this as a near-term patching priority, especially in multi-user environments. The vendor's deprecation plan for memory in v2 provides a clear long-term path but does not reduce immediate risk.

Risk score, explained

CVSS 3.1 score of 5.0 reflects a Medium severity baseline: network-accessible (AV:N), high attack complexity (AC:H), requiring authentication (PR:L), with confidentiality, integrity, and availability impacts limited to the user's security context. The availability of public exploit code and the sensitive nature of authorization bypass elevate operational risk beyond the base score, justifying prioritized patching despite the Medium rating.

Frequently asked questions