Waline EUVD-2026-112060

Exploitation requires a Waline server (<= 1.40.3) configured with the MongoDB storage adapter specifically - the match-all behavior depends on mongodb.js parseWhere() silently dropping a non-string key, so other storage backends are not stated to be affected. No authentication, user interaction, or special privilege is needed to trigger the injection and enumeration (AV:N/PR:N/UI:N against default MongoDB deployments). The critical LIMITING factor is that full administrator compromise additionally requires the attacker to already hold a valid password for the first-registered (administrator) account - the flaw removes the email factor and enables credential stuffing but does not disclose or bypass the password itself, and it only targets the first-returned user, not an arbitrary chosen account.

The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw, which on raw metrics looks like a solid priority. The real-world picture is more bounded. This is a PARTIAL authentication bypass: sending a non-string email (e.g. {"$ne": null}) to POST /api/token produces a match-all MongoDB filter so the password is checked against user[0], the first-registered account (the administrator). The injection itself is trivial and guaranteed to work against a vulnerable, MongoDB-backed instance, giving reliable user enumeration and removal of the email/identifier factor. However, actual administrator takeover is conditional on the attacker ALREADY possessing a valid password for that account (credential stuffing / reuse); the advisory itself notes this is not a zero-knowledge bypass and discloses no passwords, which is why the vendor rated it Medium. No EPSS score is provided in the input and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_month' (not act_now/emergency). A PoC HTTP request is published in the GHSA advisory, but per the available data it is a reference write-up, not verified working exploit code. Net: a genuine authentication-weakening bug worth patching on a normal priority cadence, not an emergency drop-everything issue, and its upper-bound impact (admin login) depends on a precondition outside the flaw itself.

An unauthenticated attacker sends POST /api/token with a JSON body where email is an object such as {"$ne": null} and a candidate password drawn from a breach/credential-stuffing list. The match-all filter forces Waline to check that password directly against the first-registered administrator account without the attacker ever knowing the admin's email; a reused or weak password yields an administrator session, while any attempt also confirms user existence. A PoC request is published in the GitHub Security Advisory, though it is a reference write-up rather than input-confirmed working exploit code.