RansomLook CVE-2026-78387

The attacker must hold a valid authenticated RansomLook web session - exploitation is not unauthenticated - but requires no administrator or elevated role, because the /admin/config endpoint checks only @flask_login.login_required and omits any privilege/authorization check. The specific prerequisite is network reachability to the RansomLook web interface and the presence of the /admin/config route (pre-patch versions). Limiting factors: an account of some kind is needed (so instances that issue no low-trust logins are largely protected), and direct read-back of stored credentials is partly blunted by the server-side secret-masking logic, so the practical payoff is write/tamper (integrity and availability) more than credential theft. Note the vendor CVSS encodes PR:H, which conflicts with the description's 'low-privileged user' - confirm the real minimum privilege with the vendor.

Signals partly conflict and should be weighed rather than taken at face value. The vendor CVSS 4.0 vector rates every impact High (VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) for a 9.4, but it also encodes PR:H (high privileges), which contradicts the description's core claim that a LOW-privileged authenticated user can reach the endpoint - the whole point of the missing-authorization bug. That inconsistency should be verified with the vendor; if low-priv access is real, the true privilege barrier is lower than PR:H implies, though it still requires an authenticated account (not unauthenticated). Confidentiality impact is also likely overstated: the code actively masks recognized secrets before rendering, so direct credential disclosure is partly mitigated, whereas integrity (arbitrary config rewrite) and availability (rendering the install unusable) are the genuine High impacts. There is no EPSS score, no KEV listing, and no POC in the provided data, so real-world exploitation pressure appears low and would require an attacker to already hold a valid low-tier account. Net: a legitimately serious post-authentication authorization flaw worth patching, but not an internet-wide, unauthenticated crisis - priority scales with how many low-trust accounts your RansomLook instance issues.

An attacker who has obtained (or been legitimately issued) a low-privileged RansomLook account browses to /admin/config, which returns the configuration form without any admin check, and submits crafted values - for example repointing the SMTP or notification settings to an attacker-controlled server or corrupting LDAP/general settings. The change is written to generic.json and the config cache is cleared immediately, letting the attacker silently redirect integrations or take the installation offline. No public exploit code is identified, and the attack requires only a valid session plus network access to the web UI.