CVE-2026-111644
MEDIUM
6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
7,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
Description
AI Translation Available
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0037
Percentile
0,3th
Updated
EPSS Score Trend (Last 3 Days)
306
Missing Authentication for Critical Function
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT
https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/audit.…
https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/data_c…
https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/diagno…
https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authenticat…
https://www.vulncheck.com/advisories/misaka-danmu-server-through-2.8.9-missing-…