Misaka Danmu Server EUVD-2026-103065

No special conditions beyond network reachability of the web API - the POST /api/ui/config-history/rollback endpoint lacks authentication entirely (CWE-306, PR:N), so an unauthenticated remote attacker can write configuration keys against a default deployment of Misaka Danmu Server at or below version 2.8.9. The specific precondition is that the vulnerable config-history rollback endpoint is exposed and reachable by the attacker; exploitation leverages writing the ipWhitelist (to the attacker's /32), trustedProxies, or webhookApiKey keys. The primary limiting factor is exposure scope: the server's web interface/API must be network-accessible to the attacker (e.g., internet-exposed or reachable on the LAN), and the product must be version 2.8.9 or earlier. No authentication, no user interaction, and no non-default configuration are required.

All signals point to a genuinely high-priority flaw rather than a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, fully unauthenticated exploitation with no user interaction and HIGH impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), consistent with the CWE-306 (Missing Authentication) classification and the description's claim that an unauthenticated POST to /api/ui/config-history/rollback can write arbitrary configuration keys. The technical mechanism - setting ipWhitelist to the attacker's own /32, or tampering with trustedProxies/webhookApiKey, to inherit full administrator access - is concrete and corroborated by VulnCheck's advisory and two linked source-code locations (config_history.py and security.py at tag v2.8.9), raising confidence that the bypass is real and not merely theoretical. Key signals are MISSING from the input and must be stated explicitly: no EPSS exploitation-probability score, no CISA KEV listing, and no SSVC decision data were provided, so there is no confirmation of active or widespread exploitation. The public HackMD write-up plus the VulnCheck advisory indicate the vulnerability is well-documented and easy to reproduce, which tends to drive EPSS upward over time, but exploitation itself is not confirmed. Net: treat as urgent to patch due to trivial unauthenticated admin takeover, while recognizing that real-world exploitation volume is unverified and likely constrained by the product's small deployment footprint.

An attacker who can reach the server's web API over the network sends a single unauthenticated POST to /api/ui/config-history/rollback that writes the ipWhitelist configuration key to the attacker's own /32 address (or alters trustedProxies/webhookApiKey). With the whitelist now trusting the attacker, every protected endpoint is accessible with administrator privileges, yielding full control of the application. A public technical write-up (HackMD) and a VulnCheck advisory describe the flaw in detail, but no packaged exploit tool was identified in the provided data.