Misaka Danmu Server EUVD-2026-103066

No special conditions beyond network reachability - the audit, diagnostics, data-check, scan-index, and health routes under /api/ui ship without the get_current_user authentication dependency in default builds of Misaka Danmu Server through 2.8.9, so any attacker who can reach the HTTP service exploits it unauthenticated against a default configuration. The primary limiting factor is exposure: this is a self-hosted application typically deployed on a LAN or behind a reverse proxy, so impact is confined to instances whose /api/ui surface is directly reachable by the attacker; there is no user-interaction or authentication requirement to mitigate the flaw once the port is reachable.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation requiring no user interaction, which is a serious access profile for a missing-authentication flaw (CWE-306). However, the impact metrics are all rated Low (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N), keeping the score at 6.9 (Medium) because an attacker gains partial disclosure (audit logs with login IPs, server logs, environment paths) and partial tampering (deleting episode rows, clearing media-server mappings, wiping audit history) rather than full system compromise or code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no POC flag was supplied, so there is no evidence of active exploitation; the real limiter on risk is the product's small deployment footprint rather than the attack mechanics. A detailed third-party technical writeup (hackmd) and exact vulnerable source lines are publicly referenced, which materially lowers the effort to develop a working exploit even though no weaponized code is flagged. Net: easy to exploit where reachable, but low per-instance impact and niche exposure make this a moderate concern concentrated on internet-exposed instances.

An attacker locates an internet-exposed Misaka Danmu Server (≤2.8.9) and directly requests the unauthenticated /api/ui audit, diagnostics, and data-check routes. They read audit logs to harvest administrator login IP addresses, server logs, and environment paths, then issue destructive calls to delete episode rows, clear media-server mappings, and wipe the audit history to remove evidence. No exploit code is flagged as public, but a detailed technical writeup and the exact vulnerable source lines are referenced, making exploitation trivial given the network-accessible, low-complexity vector.