CVE-2026-108372: LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

loopx serve-status sends Access-Control-Allow-Origin: * on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction.

The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about the read paths.