RansomLook EUVD-2026-64841

The attacker requires only network-level HTTP access to the RansomLook web interface - no account, no session, and no specific configuration is required on the attacker's side. The CVSS PR:N and UI:N confirm unauthenticated, fully autonomous exploitation. Exploitation is bounded by network exposure: deployments restricted to VPN or internal networks are not reachable by external attackers, which is the primary limiting factor. The vulnerability is specific to the /admin/crypto/group/new route; other admin routes already protected by login_required are unaffected. No non-default application configuration is required on the target - the vulnerability exists in any unpatched deployment regardless of how it is configured.

The CVSS 4.0 score of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N reflects genuine ease of exploitation - no tooling beyond a standard HTTP client is required. The impact metrics (VC:N/VI:L/VA:H/SC:N/SI:L/SA:N) indicate no confidentiality exposure but high availability concern, likely from the ability to flood the crypto group table with arbitrary entries, degrading application performance or corrupting analyst-facing data. The integrity impact on subsequent systems (SI:L) reflects how poisoned crypto group entries could propagate into downstream intelligence workflows. No CISA KEV listing and no public exploit code are identified, which meaningfully lowers the probability of opportunistic exploitation. However, RansomLook is often deployed by security teams who may expose it to internal networks without expecting it to need hardening against unauthenticated write access. Real-world risk is highest for internet-facing instances; network-restricted deployments face substantially reduced exposure.

An attacker with HTTP access to a publicly exposed RansomLook instance sends unauthenticated POST requests to /admin/crypto/group/new with crafted parameters, injecting fraudulent ransomware group entries directly into the database. Repeated rapid submissions could flood the crypto group table, degrading application performance or corrupting threat intelligence feeds reviewed by security analysts. No public exploit code has been identified, but the attack requires no specialized tooling - only the ability to form valid HTTP requests to the endpoint.