Lookyloo CVE-2026-55835

Requires a Lookyloo instance running version <=1.39.3 that has a MISP backend configured - without a configured MISP instance there is no availability impact. The attacker must know or obtain a valid capture UUID and send an unauthenticated POST to /json/<uuid>/report with a non-empty (truthy) 'email' value, which is misassigned to the as_admin parameter and forces admin-mode MISP search queries. Limiting factors: no authentication or user interaction is needed, but impact is confined to the optional MISP subsystem (the vendor describes DoS only as 'potential'/'could potentially'), there is no leak to the submitter, and upgrading to 1.39.4 (which switches to named arguments and adds an email-regex guard) fully resolves it.

Signals are consistent and point to a genuine but limited-severity issue rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability, which matches the described unauthenticated POST to /json/<uuid>/report. However, the only impact metric set is SA:L (subsequent-system availability, Low) with VC/VI/VA all N - the vendor explicitly states there is no information leak because MISP results go to the analyst, not the submitter, so the realistic worst case is a potential DoS of an OPTIONAL, separately-deployed MISP instance. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the Low confidentiality/integrity impact. No EPSS score, no CISA KEV listing, and no SSVC decision data were supplied; a PoC curl command is published in the GHSA advisory, but it is a reference, not confirmed working weaponized exploit code. The 'Information Disclosure' tag conflicts with the advisory text, which explicitly denies any disclosure - treat the impact as availability/DoS only. Net: a legitimate fix-this-month hygiene item, not a high-urgency incident, and the DoS is only reachable where a MISP instance is configured.

An attacker with a valid capture UUID sends an unauthenticated POST to /json/<uuid>/report supplying a truthy 'email' value that, due to a positional-parameter bug, overwrites the as_admin flag to True. If the Lookyloo instance has a MISP backend configured, each such request forces an admin-mode MISP search, and repeated requests could overwhelm the analyst's MISP instance. A public PoC reference exists in the GHSA advisory; it is not verified as working exploit code.