CVE-2026-111643
9.8CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can take full administrator control over all protected endpoints by overwriting sensitive settings like ipWhitelist, trustedProxies, and webhookApiKey. They only need network access to the HTTP service.
Root cause
The POST /api/ui/config-history/rollback endpoint lacks authentication, allowing anyone to trigger arbitrary configuration rollbacks and overwrite keys.
Affected systems
Misaka Danmu Server through 2.8.9
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed version is specified in the advisory; restrict network access to the server or block requests to POST /api/ui/config-history/rollback at your reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
References
- https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/config_history.py#L51-L66
- https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/security.py#L136-L182
- https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication
- https://www.vulncheck.com/advisories/misaka-danmu-server-through-2.8.9-authentication-bypass-via-config-history-rollback