CVE-2026-111643

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

The flaw lets unauthenticated attackers modify critical configuration and gain administrative access, potentially leading to full system takeover. Changing the IP whitelist can permanently open access for the attacker.

Update Misaka Danmu Server to a patched version or secure the /api/ui/config-history/rollback endpoint with authentication. Also audit the configuration for unauthorized changes.