Vulnerability-Lookup CVE-2026-73405

Exploitation requires that the target Vulnerability-Lookup instance has user self-registration enabled - this is the mechanism by which an attacker obtains an API key prior to account confirmation. The attacker must have network access to the /pubsub/subscribe/<topic> HTTP endpoint. The CVSS 4.0 vector confirms PR:L: a self-registered, unconfirmed account suffices; no elevated privileges, administrator access, or pre-existing confirmed account is needed. Exploitation is limited by the following concrete conditions: instances where self-registration is administratively disabled prevent attackers from obtaining a pre-confirmation API key via this path; network-level restrictions (firewall rules, reverse-proxy ACLs) on the /pubsub/subscribe/ path prevent stream access regardless of key validity; and deployments that publish no sensitive pre-moderation data to Pub/Sub streams reduce the practical impact even if the endpoint is reachable.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 (Medium), indicating network-reachable exploitation requiring low privileges (an unconfirmed self-registered account) with limited confidentiality impact. No EPSS score was provided in the input data. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified - this is a patch-and-move-on scenario rather than an active incident. Real-world risk is further bounded by deployment context: instances with self-registration disabled eliminate the primary attack path entirely, and the data exposed is limited to SSE stream events (pre-moderation comments, newly submitted records) rather than the full vulnerability database. The VI:L component in the provided CVSS 4.0 vector is not clearly supported by the description, which describes read-only subscription access - integrity impact is not independently confirmed from the available data. In threat-intelligence sharing deployments (the primary use case for this platform), unauthorized visibility into pre-moderation submissions carries meaningful operational sensitivity, but this does not constitute a broad critical risk for most environments.

An attacker targeting a public-facing Vulnerability-Lookup instance with self-registration enabled creates an account and immediately extracts the API key issued during registration - before completing email confirmation. Using a standard SSE client or curl with an Accept: text/event-stream header and the X-API-KEY value, the attacker connects to /pubsub/subscribe/<topic> and begins receiving a live stream of pre-moderation events, such as newly submitted vulnerability comments pending moderator review, without the account ever being confirmed. No public exploit code has been identified, and the technique requires only basic HTTP client knowledge.