{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "0"
              },
              {
                "fixed": "2.106.0"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "c43d80488139605bc939a3b61613e9181c0553f9"
            }
          ],
          "repo": "https://github.com/wireapp/wire-server",
          "type": "GIT"
        }
      ]
    }
  ],
  "details": "wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-Origin ` header set by `nginz` is set for all subdomains of `.wire.com` (including `wire.com`). This means that if somebody were to find an XSS vector in any of the subdomains, they could use it to talk to the Wire API using the user's Cookie. A patch does not exist, but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another, one may limit the `Access-Control-Allow-Origin` header to apps that actually require the cookie (account-pages, team-settings and the webapp).",
  "id": "CVE-2021-41101",
  "modified": "2026-03-13T21:54:25.966945818Z",
  "published": "2021-09-30T20:15:07.587Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-v7xx-cx8m-g66p"
    }
  ],
  "related": [
    "GHSA-v7xx-cx8m-g66p"
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}