CVE-2026-61718
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In BunkerWeb versions 1.6.2 through 1.6.12, the BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, allowing low-privilege read-only accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.
Risk Assessment
The risk is that an unauthorized user can permanently delete critical configuration data and blocklists, potentially disrupting WAF protection and compromising system integrity.
Recommendation
Immediately upgrade BunkerWeb to version 1.6.12 or later, which fixes the vulnerability by correcting the authorization bypass list.
Other vulnerabilities in BunkerWeb
See all- CVE-2026-75514Medium
BunkerWeb prior to 1.6.13 has a vulnerability in the blacklist, greylist, and antibot modules that trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge.
- CVE-2026-54728Medium
A vulnerability in BunkerWeb and BunkerWeb PRO prior to versions 1.6.12 and 0.57 allows a low-privileged authenticated user to escalate privileges through improper validation of the Host header in the UI and API. The issue affects a configuration-dependent input processing path.
Original NVD description (English source)
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @login_required, including POST /cache/delete, allowed low-privilege read-only reader accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.