CVE-2026-111626
CVE-2026-111626 · Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
CVSS 9.3 · Kritisch · EPSS 0,4%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
damselfly
- Softwareversionen
- ≥ 0, ≤ 4.5.3: Betroffen (custom)
Keine Korrektur veröffentlicht
Originalquellen
- https://hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242
- https://github.com/Webreaper/Damselfly/issues/409
- https://www.vulncheck.com/advisories/webreaper-damselfly-through-4.5.3-missing-authentication-on-rest-api-controllers
- https://nvd.nist.gov/vuln/detail/CVE-2026-111626