RansomLook CVE-2026-78370

The RansomLook web application must be network-reachable by the attacker and the vulnerable legacy /export/<database> route must be present (pre-commit-ff97a34 code). Exploitation targets the specific exportable databases that were returned without consistent private-entity filtering - groups, markets, and posts - and only yields sensitive data if the instance actually contains entries marked private. No authentication, user interaction, or special configuration is required on those code paths (PR:N/UI:N/AC:L). Limiting factors: instances that are not internet-exposed, are behind an authenticating proxy/VPN, or hold no private-marked records are not meaningfully exposed; entity databases that already had filtering applied do not leak.

This is a genuine high-priority exposure for anyone running a public-facing RansomLook instance that stores private entries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) means network-reachable, low-complexity, no authentication and no user interaction - a single crafted request to the export endpoint suffices, which is exactly the profile that gets scraped and automated once details are public. The impact is confidentiality-only (VC:H, integrity and availability unaffected), so it is disclosure rather than takeover; there is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified, so the 9.2 score reflects ease-of-exploitation potential rather than confirmed in-the-wild activity. The real-world blast radius is bounded by how many instances are internet-exposed and actually hold private-marked data - a self-hosted, access-restricted instance is far lower risk than a publicly reachable one. Because the leaked content can include victim identities and internal tracking data, any operator running an exposed instance should treat patching as urgent even though EPSS-style widespread-exploitation signals are absent.

An attacker who can reach a public-facing RansomLook instance sends a simple GET request to the /export/<database> endpoint for one of the inadequately filtered databases (e.g., posts or groups). The server returns a full export that includes records flagged private, handing the attacker private ransomware intelligence and victim information without any credentials. Given AV:N/AC:L/PR:N, this requires only HTTP reachability and can be scripted; no public exploit is currently identified but the technique is trivial to reproduce.