Description
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-111626 ↗
- github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs ↗
- github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs ↗
- github.com/Webreaper/Damselfly/issues/409 ↗
- hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization ↗
- www.vulncheck.com/advisories/webreaper-damselfly-through-4.5.3-missing-authentication-on-rest-api-controllers ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.