SuggestArr EUVD-2026-105106

Exploitation requires the SuggestArr instance to be running in 'local_bypass' authentication mode AND deployed behind a reverse proxy with ProxyFix(x_for=1) active (both the documented, non-default conditions - the upgrade notes specifically warn operators running local_bypass behind a proxy). Given those conditions, the attacker needs only network reachability to the application and the ability to set the X-Forwarded-For header to a trusted CIDR value such as 127.0.0.1; no credentials, user interaction, or prior access is required. The primary limiting factor is the configuration itself: default installations that do not enable local_bypass are not affected, so the realistic exposed population is restricted to proxy-fronted deployments that opted into IP-based bypass.

Risk is conditional rather than universal. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H) scores 9.1 (Critical) and correctly reflects a network-reachable, unauthenticated, low-complexity attack with high confidentiality and integrity impact - but the AT:P (Attack Requirements: Present) flag is the decisive signal: exploitation is only possible when the optional 'local_bypass' authentication mode is enabled behind a reverse proxy, which is NOT the default. This tempers the raw criticality. No EPSS score was provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis' (VulnCheck published an advisory, but no public exploit code is indicated in the input). Against affected deployments the technique is trivial (spoof a single HTTP header), so the signals are internally consistent - high technical impact gated by a specific, operator-chosen configuration. Net: a genuine high priority for the subset of SuggestArr instances running local_bypass behind a proxy, but a low real-world risk for the majority running default auth. Missing data to note explicitly: EPSS probability is absent, and POC/KEV are both negative, so prioritization should rest on whether local_bypass is in use, not on exploitation telemetry.

An attacker who can reach a SuggestArr instance that was configured with local_bypass mode behind a reverse proxy sends an HTTP request with the header 'X-Forwarded-For: 127.0.0.1'. Because ProxyFix(x_for=1) causes Flask to trust that header as request.remote_addr, enforce_authentication() treats the request as originating from a trusted CIDR and loads an admin session via _load_bypass_user_context(), granting full administrative access to endpoints such as /api/users and /api/jobs with no credentials. No public exploit code is identified at time of analysis, though the single-header technique is simple to reproduce.