CVE-2026-111626
CVE-2026-111626 · Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
CVSS 9.3 · Crítica · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
damselfly
- Versiones
- ≥ 0, ≤ 4.5.3: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242
- https://github.com/Webreaper/Damselfly/issues/409
- https://www.vulncheck.com/advisories/webreaper-damselfly-through-4.5.3-missing-authentication-on-rest-api-controllers
- https://nvd.nist.gov/vuln/detail/CVE-2026-111626