EUVD-2026-88619
GHSA-6hf7-jgwh-5jh8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed Circleback webhook URL
-
DeliveryCraft forged webhook POST payload
-
ExploitSend unauthenticated request to endpoint
-
ExecutionEndpoint processes without auth check
-
ImpactInject/overwrite meeting-note data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the SurfSense instance has the Circleback integration/webhook endpoint (circleback_webhook_route.py) enabled and network-reachable by the attacker; the endpoint performs no authentication, so any remote party who can reach it can POST forged payloads. Limiting factors: the Circleback webhook feature must be configured/deployed (not necessarily a default), the endpoint must be exposed to the attacker's network, and impact is confined to the data that this specific webhook handles (Low confidentiality/integrity/availability) rather than the whole application. No user interaction or credentials are needed. |
| Impact | This is a genuine but low-severity issue best characterized as high-visibility-but-modest-impact rather than a top-tier priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, unauthenticated, low-complexity flaw requiring no user interaction, which is why it scores 6.9 (Medium). However, all three impact dimensions are rated Low (VC:L/VI:L/VA:L) with no subsequent-system impact (SC/SI/SA:N), and CWE-306 (missing authentication) on a single webhook endpoint limits blast radius to whatever data that endpoint ingests/exposes - not full application compromise. The E:P (Proof-of-Concept) exploit maturity in the vector aligns with the reported public POC gist. There is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of active or widespread exploitation - consistent with a niche open-source product and a targeted, integration-specific bug. Note the 'Authentication Bypass' tag is loose: the CWE-306 root cause is missing authentication on a webhook (no auth check ever runs), not a bypass of an existing auth mechanism. Net: real and easy to trigger where the Circleback integration is configured, but low impact and low deployment footprint keep real-world priority low. |
| Exploit ScenarioDerived | An attacker who knows or discovers the SurfSense Circleback webhook URL sends crafted, unauthenticated HTTP POST requests directly to the /circleback webhook endpoint, which performs no sender verification. This lets them forge or inject fabricated meeting-note/webhook payloads (and potentially read or overwrite associated content), tampering with the integrity of ingested data. A public proof-of-concept exploit is available (gist by DReazer), lowering the skill bar to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Missing authentication in the Circleback webhook handler of MODSetter SurfSense (up to and including 2.0.3) lets any remote party who can reach the endpoint submit forged webhook payloads without credentials, yielding low-impact confidentiality, integrity and availability effects scoped to whatever that webhook processes. Exploitation requires the Circleback integration to be enabled and network-reachable; no user interaction is needed and publicly available exploit code exists, though there is no evidence of confirmed active exploitation. With a CVSS 4.0 base score of 6.9 (E:P) and no vendor response to the disclosure, this is a modest-impact but easily testable exposure that should be closed by removing or firewalling the endpoint.
RemediationAI
No vendor-released patch was identified at time of analysis: the vendor was contacted early about the disclosure but did not respond, and no fixed SurfSense version is documented in the available references. Because the defect is a missing-authentication flaw rather than a code-execution bug, the most effective immediate action is to eliminate the exposed attack surface - if the Circleback integration is not in active use, remove or disable the circleback webhook route/integration entirely (trade-off: Circleback event ingestion stops working). If the integration must stay live, place the endpoint behind an authenticating reverse proxy or gateway that requires a shared secret, client certificate, or allow-listed source IP, and restrict inbound access to the Circleback service's published egress ranges so arbitrary internet clients can no longer reach it (trade-off: misconfigured allow-lists or rotate-able secrets will silently drop legitimate callbacks and require monitoring/tuning). Additionally, treat the endpoint as untrusted input: validate and rate-limit webhook payloads, and review downstream actions the handler can trigger so a forged event cannot mutate sensitive data. Until an authenticated version is released, organizations should track the VulDB record (https://vuldb.com/vuln/411143) and the vendor project for a fixed release; there is no evidence of confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists, so exposure checks and log review for unexpected POSTs to the Circleback route are warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is surfsense_backend/app/routes/circleback_webhook_route.py, the HTTP route that receives callback events from the Circleback meeting/transcription integration in MODSetter SurfSense. The root cause is CWE-306 (Missing Authentication for Critical Function): the route handler does not verify any shared secret, signature, or session before acting on an inbound request, so it trusts any POST that arrives. Webhook endpoints of this kind are normally protected by an HMAC signature header or a pre-shared token; here that control is absent in versions up to and including 2.0.3. The CPE string cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:* matches all released SurfSense versions, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) confirms an unauthenticated, network-reachable, no-interaction attack with limited impact confined to the webhook's own data - not the entire application. The disclosure originated with VulDB, and the vendor was contacted but did not respond.
Know when Surfsense gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable webhook with no authentication check (PR:N, AC:L, UI:N); impact limited to data the single endpoint ingests/exposes, so C/I/A each Low and scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Command injection in MODSetter SurfSense through version 2.0.3 allows an authenticated low-privilege user to execute arb
Server-side request forgery (SSRF) in MODSetter SurfSense 0.0.36 and earlier allows an authenticated, low-privilege user
Exploit-DB