CVE-2026-9371
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A missing authentication vulnerability was found in the API component of Vane up to version 1.12.1, specifically in the route.ts file. The attack can be performed remotely but is considered difficult. The exploit has been publicly disclosed.
Risk Assessment
Lack of authentication could allow unauthorized users to access sensitive API functions, potentially leading to data leakage or unauthorized actions.
Recommendation
Immediately update Vane to the latest version and implement authentication mechanisms for all API endpoints.
Other vulnerabilities in Vane
Original NVD description (English source)
A security vulnerability has been detected in ItzCrazyKns Vane up to 1.12.1. Affected by this issue is some unknown functionality of the file route.ts of the component API. The manipulation leads to missing authentication. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. It appears that basic authentication is planned.