RansomLook CVE-2026-78380

Exploitation requires two concurrent conditions on the target RansomLook instance: (1) at least one external notification channel (Rocket.Chat, Mastodon, Bluesky, or email) or the public MISP feed must be enabled and actively distributing posts, and (2) at least one ransomware group or market tracked by the instance must be configured with the private flag. The attacker must already have legitimate access to the notification channel or MISP feed - for example, as a Mastodon follower, Rocket.Chat room member, or MISP feed subscriber - but requires no credentials or interaction with the RansomLook application itself. Exploitation is limited to confidentiality impact (information disclosure only); no code execution, privilege escalation, or data modification is possible through this path. Deployments that monitor only public-flagged groups and markets, or that have all external channels and MISP feed output disabled, are not affected regardless of version.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the mechanics: data leaks through externally accessible push channels to parties who need no technical skill beyond being a subscriber. Real-world risk is concentrated in deployments that actively monitor private ransomware intelligence - pre-disclosure victim names, unreleased incident data - and have external notification channels or MISP feed output enabled. Deployments tracking only public groups and markets, or with all external channels disabled, carry no meaningful exposure. No EPSS score was provided in the input data; the absence of a CISA KEV listing and no reported POC indicate exploitation has not been observed in the wild as of this analysis. The passive exploitation model - receive a broadcast rather than send a crafted request - means no technical barrier exists once channel access is obtained, but that access itself is a prerequisite that limits the realistic attacker population to existing subscribers. No conflicts between the CVSS vector and the vulnerability description are present; the network attack vector is appropriate because the leakage path is the externally accessible notification infrastructure, not the RansomLook application interface itself.

A threat actor or unauthorized researcher who subscribes to a RansomLook instance's public Mastodon account, Bluesky feed, Rocket.Chat room, or MISP feed passively receives victim notifications for ransomware groups or markets the operator had explicitly marked private - such as pre-disclosure incident intelligence or victim names under embargo. No interaction with the RansomLook application is required; the data is pushed automatically by the misconfigured broadcast logic whenever the crawler parses a new victim post for a private entity. No public proof-of-concept exploit code exists at time of analysis.