RansomLook CVE-2026-78386

No special conditions are required for a remote unauthenticated attacker to retrieve the sensitive fields - the only implicit condition is that a given location record must not have been explicitly marked private by the operator (location.get('private') is not True). Default-created location records are not private unless manually flagged, meaning the majority of monitored sites are affected. Exploitation requires only network-level reachability to the RansomLook web API and knowledge of a valid group or market name (which are often publicly known from ransomware intelligence sources). Factors limiting real-world exploitation include RansomLook's relatively narrow operator footprint (it is not a mass-deployed consumer product) and the requirement that an attacker know or enumerate valid group names to query. There is no authentication, no rate limiting mentioned, and no complexity barrier once the endpoint is reachable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: unauthenticated network access, no complexity or preconditions, and high confidentiality impact with no integrity or availability effect. The 8.7 score correctly reflects the severity of credential exposure over an open API. No EPSS score was provided in the source data, and RansomLook is not currently listed in the CISA KEV catalog, so exploitation probability must be inferred rather than confirmed. The real-world risk is narrower than the CVSS score might suggest in aggregate terms, because RansomLook has a small operator footprint (specialist threat intelligence teams), but for any organization running it the impact is operationally serious: leaked header values can be replayed to authenticate against monitored extortion sites, and leaked init_script logic reveals proprietary CAPTCHA-bypass techniques that site operators or adversaries could use to detect and block RansomLook's collection pipeline. No conflict exists between the CVSS vector and the description. No POC has been identified, but the vulnerability requires only a standard unauthenticated HTTP GET, meaning the barrier to independent discovery is extremely low.

An attacker queries RansomLook's public-facing API endpoint for group or market location data - for example, GET /api/v1/group/<name>/locations - without supplying any credentials. The response includes the unredacted header field containing HTTP authentication headers or session cookies used by RansomLook to access the monitored site. The attacker replays these credentials directly against the target site to gain authenticated access, or extracts the init_script logic to understand and neutralize RansomLook's CAPTCHA bypass, silently blinding the platform's collection capability.