CVE-2026-111626
CVE-2026-111626 · Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
CVSS 9.3 · Critical · EPSS 0.4%
- Published
- Updated
Affected products and versions
damselfly
- Versions
- ≥ 0, ≤ 4.5.3: Affected (custom)
No fix published
Original sources
- https://hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242
- https://github.com/Webreaper/Damselfly/issues/409
- https://www.vulncheck.com/advisories/webreaper-damselfly-through-4.5.3-missing-authentication-on-rest-api-controllers
- https://nvd.nist.gov/vuln/detail/CVE-2026-111626