Miaomiaowu EUVD-2026-113935

Requires a valid authenticated account on the Miaomiaowu instance (any low-privileged user; PR:L), and exploitation targets the /api/user/proxy-provider-configs endpoint by supplying external_subscription_id values the attacker does not own. The decisive condition is that this ID is a GLOBAL auto-increment value shared across all users, so an attacker simply iterates integers to enumerate every subscription; no victim interaction, no non-default configuration, and no admin rights are needed. Limiting factors: the attacker must already be authenticated, exploitation is confined to multi-user/shared deployments (a single-user instance has nothing to cross-read), and impact is read-only disclosure of proxy-provider config fields (override scripts, filter rules, custom request headers, health-check URLs) with no write or service-disruption capability.

This is a moderate-severity, authenticated information-disclosure flaw (CWE-639 IDOR) rather than a critical or widely-weaponized issue. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, score 5.3) is internally consistent with the description: network-reachable, low attack complexity, but requiring a valid low-privileged account (PR:L) and yielding only confidentiality impact (VC:L) with no integrity or availability effect. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the moderate score. It is not in CISA KEV, and no EPSS probability was provided in the input, so exploitation-likelihood cannot be quantified from the data; a public write-up reference (hackmd) exists but is not verified as working exploit code. One signal the raw CVSS understates: the disclosed data includes custom upstream request headers - the vendor's own regression test populates these with an 'Authorization' secret - so the practical confidentiality impact may exceed VC:L if those headers carry upstream credentials, a factor defenders should weigh above the numeric score. The 'Authentication Bypass' tag is misleading: this is cross-user authorization bypass among already-authenticated users, not an authentication bypass. Overall this is a real but second-tier priority: patch within the normal cycle, prioritized higher only where the stored headers contain sensitive upstream tokens.

A logged-in user of a shared Miaomiaowu instance calls GET /api/user/proxy-provider-configs supplying external_subscription_id values they do not own, incrementing through the global auto-increment ID space. Because the storage query filtered only by subscription ID and not by username (confirmed in the patch diff), the server returns other users' proxy-provider configurations - override scripts, filter rules, health-check URLs and custom request headers. A public write-up reference describing the issue exists, but it is not verified as working exploit code.