EUVD-2026-71632
GHSA-p58p-wgx6-x52q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access to a read-only stats endpoint yields only low confidentiality impact; no integrity or availability effect applies.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unauthenticated access to the stats/login endpoint in jofpin trape 1.0.0 exposes collected tracking statistics to any remote party without credentials via the core/stats.py component. The missing authentication check (CWE-287) allows the statistics interface to be queried freely over the network, leaking data about tracked individuals - a meaningful privacy concern given trape's purpose as a people-tracking OSINT tool. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the Login Endpoint in core/stats.py does not enforce credential validation, making the stats interface directly accessible to any remote party with network connectivity to the trape instance (CVSS PR:N confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.5 (Moderate) correctly reflects a bounded impact: low confidentiality (VC:L) with no integrity or availability effect, consistent with unauthenticated read-only access to a stats endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the maintainer was notified via GitHub issue #405 (https://github.com/jofpin/trape/issues/405) but had not responded at the time of disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today