CVE-2026-111644

HighCVSS 7.3

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Summary

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.

Risk Assessment

An unauthenticated attacker can access sensitive information such as login IPs and server paths and modify or delete data, compromising confidentiality and integrity.

Recommendation

Upgrade Misaka Danmu Server beyond 2.8.9 and enforce authentication (get_current_user dependency) on all routes under /api/ui.

Other vulnerabilities in Misaka Danmu Server

CVE-2026-111643Critical
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS