What is the CVSS score of CVE-2026-59148?

CVE-2026-59148 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Mockoon are affected by CVE-2026-59148?

Mockoon versions prior to 9.7.0 contain an unauthenticated admin API that allows any network-accessible attacker to read environment variables (including credentials and API keys), modify mock…. A patch is available.

How to fix or mitigate CVE-2026-59148?

Within 24 hours: Identify all Mockoon instances running versions earlier than 9.7.0 and restrict network access to their administrative ports. Within 7 days: Upgrade all instances to Mockoon 9.7.0 or later. Within 30 days: Audit access logs for unauthorized admin API calls and rotate any environment variables or credentials that may have been exposed.

Mockoon CVE-2026-59148

EUVD-2026-42683 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-09 GitHub_M

Authentication Bypass Mockoon

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 09, 2026 - 20:01 EUVD

Analysis Generated

Jul 09, 2026 - 19:03 vuln.today

DescriptionCVE.org

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.

AnalysisAI

Missing authentication on Mockoon's admin API (commons-server admin-api.ts) prior to 9.7.0 lets any unauthenticated party who can reach the mock server port fully control the runtime. Because the admin routes are mounted on the same Express listener as user mock routes, enabled by default, serve Access-Control-Allow-Origin: * with write methods, and require no credentials, an attacker can read MOCKOON_* environment variables, write arbitrary process env vars, rewrite mock route bodies/statuses/headers, read transaction logs and SSE streams, and purge state. …