EUVD-2026-57223
GHSA-8gv5-4q99-4cxm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because a self-registered unconfirmed account suffices; C:L for limited stream event exposure; I:N and A:N as description supports read-only subscription only.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint.
The token_required decorator used by the Pub/Sub interface authenticated requests solely by matching the X-API-KEY header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account's is_active and is_confirmed state.
Because the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments.
The vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface.
The patch corrects the issue by requiring accounts to be both active and confirmed before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API.
AnalysisAI
Inconsistent authorization enforcement in Vulnerability-Lookup's SSE streaming interface allows self-registered but unconfirmed or inactive accounts to subscribe to Pub/Sub event streams, accessing pre-moderation data that the REST API correctly restricts. The platform's self-registration flow issues an API key before account confirmation is complete, and the token_required decorator on /pubsub/subscribe/<topic> validated only that the key matched a known user - not that the account was active or confirmed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Vulnerability-Lookup instance has user self-registration enabled - this is the mechanism by which an attacker obtains an API key prior to account confirmation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 (Medium), indicating network-reachable exploitation requiring low privileges (an unconfirmed self-registered account) with limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a public-facing Vulnerability-Lookup instance with self-registration enabled creates an account and immediately extracts the API key issued during registration - before completing email confirmation. Using a standard SSE client or curl with an Accept: text/event-stream header and the X-API-KEY value, the attacker connects to /pubsub/subscribe/<topic> and begins receiving a live stream of pre-moderation events, such as newly submitted vulnerability comments pending moderator review, without the account ever being confirmed. … |
| Remediation | Apply the upstream fix by updating Vulnerability-Lookup to a version that incorporates commit bef837242657acf680832be56b94428df130ed67 (https://github.com/vulnerability-lookup/vulnerability-lookup/commit/bef837242657acf680832be56b94428df130ed67), which adds is_active and is_confirmed account-state checks to the token_required decorator in website/web/views/pubsub.py, aligning SSE authorization with the REST API gate. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Vulnerability Lookup
View allToken replay in Vulnerability-Lookup's account activation and password-recovery mechanism allows an attacker who capture
SSRF guard bypass in Vulnerability Lookup's webhook notification subsystem allows a network attacker to register a webho
Stored cross-site scripting in Vulnerability-Lookup's render_tag_badges Jinja filter allows an authenticated user holdin
Server-side request forgery in Vulnerability-Lookup's remote-instance synchronization feature enables an authenticated a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today