CVE-2026-111626

9.8Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-306

Impact

Unauthenticated remote attackers can create admin accounts or reset any user's password to gain full administrative control over the application. All they need is network access to the API endpoints.

Root cause

Authorization attributes on API controllers were commented out in the source code, leaving all /api/* routes completely unauthenticated.

Affected systems

Webreaper Damselfly through 4.5.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a version newer than 4.5.3 when available. If patching must wait, block or restrict public access to all /api/* endpoints using your reverse proxy or firewall.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111626