CVE-2026-102245
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A weakness has been identified in MODSetter SurfSense up to 2.0.3 in an unknown function of the surfsense_backend/app/routes/circleback_webhook_route.py file of the circleback Endpoint component. Executing a manipulation can lead to missing authentication. The attack can be launched remotely and the exploit has been made public.
Risk Assessment
A remote attacker can invoke the circleback endpoint without authentication, potentially leading to unauthorized operations or data integrity issues.
Recommendation
Update MODSetter SurfSense to a patched version and implement authentication for all webhook endpoints.
Other vulnerabilities in MODSetter SurfSense
Original NVD description (English source)
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS