EUVD-2026-64845
GHSA-3r47-x6xh-cmv8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public RansomLook web instance
-
DeliveryIdentify private group name or slug
-
ExploitQuery /compare?a=<private-group> or note/search API
-
ExecutionBypass missing authorization check
-
ImpactDisclose private names, note content and metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of RansomLook, per CVSS AV:N/AC:L/AT:N/PR:N/UI:N. The prerequisite is simply that the target has entities marked private (the flaw only discloses data that was intended to be restricted); for the /compare vector the attacker must supply the name/slug of a private group or market as a query parameter (e.g. ?a=<name>), and for note disclosure the note must belong to a private group or an alias of one. The limiting factor is that only confidentiality of private tracking data is at stake - there is no write, code-execution, or availability impact - and instances with no private-flagged entities have nothing to leak. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes trivially reachable, unauthenticated, no-interaction exploitation - the ideal profile for scanning and scraping - which justifies the 9.2 critical rating. However, impact is confidentiality-only (VC:H, with VI:N/VA:N): there is no integrity or availability effect, and the disclosed data is threat-intel content (private group/market names, ransom-note text, and aggregate metadata), not credentials or system-level secrets, so the practical blast radius is narrower than the raw score suggests. The vendor-assigned SC:H (subsequent-system confidentiality) is arguable - the leaked data lives within the application itself rather than a distinct downstream system - and I weight this closer to a same-scope disclosure. There is no CISA KEV listing and no public exploit identified, so despite the high score this is not confirmed to be under active exploitation; the real-world urgency is highest for operators who rely on the private flag to withhold sensitive or embargoed tracking data, since exploitation requires only a crafted HTTP request against a default deployment. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates or guesses the name of a private group and requests /compare?a=<private-group> (or hits the note/search API endpoints), retrieving the entity's post counts, mirror totals, uptime, and private ransom-note content that the UI deliberately hides. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only scripted HTTP requests with no login or user interaction; no public exploit is currently identified, but the technique is straightforward to automate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remote attackers read data explicitly marked private. Several web views and API endpoints (notably /compare, ransom-note views, and search) failed to filter entities flagged as private, exposing private group and market names, ransom-note content, and metadata such as post counts, mirror totals, and uptime. Rated CVSS 4.0 9.2 (critical); a vendor patch exists (commit dc92d6d) and no public exploit has been identified at time of analysis.
RemediationAI
Apply the vendor patch by updating to a build that includes upstream commit dc92d6d5c076bcdbf3476aca42daf0260e8d99d7 (Patch available per vendor advisory / upstream fix available as a commit; a tagged patched release version is not independently confirmed in the input). The fix adds normalized private-group slugs with alias handling and inserts privacy checks into the notes(), notesdetails(), search(), and compare() handlers plus the notes API, filtering private entities before returning them. If you cannot deploy the commit immediately, place the RansomLook web instance behind authentication or an IP allowlist/reverse-proxy restriction so anonymous callers cannot reach /compare, /notes, note-detail, search, and the notes API endpoints - the trade-off is that legitimate anonymous public browsing is disabled. As a narrower stopgap, block or require auth on the /compare endpoint and note/search API routes at the proxy, accepting loss of those features, until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RansomLook is a Python/Flask web application backed by Valkey/Redis (DB_NOTES) that indexes ransomware group and market activity for threat-intelligence use. The root cause is CWE-862 (Missing Authorization): privacy was enforced inconsistently across code paths, so several handlers returned data without calling the privacy gate. Ransom notes are keyed in Valkey under 'idx:group:<slug>:notes', and the fix introduces slug normalization (norm_group_slug) plus alias resolution (get_private_note_slugs) so that notes tagged with an alias of a private group are also filtered - the prior canonical-only logic left aliased notes exposed. The /compare handler's compute() filtered private *locations* but never checked the entity's own 'private' flag, so ?a=<private-group> still returned computed stats. The CPE cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* indicates all versions prior to the fix are affected.
Know when Ransomlook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Unauthenticated network request, low complexity, confidentiality-only disclosure of restricted data with no integrity/availability impact; disclosure stays within the application, so scope unchanged (S:U).
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
DescriptionCVE.org
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints.
The affected functionality can disclose private group or market names, ransom-note content, and metadata associated with private groups. The /compare functionality can also be queried directly with the name of a private entity, allowing an unauthorized user to retrieve information such as post counts, mirror totals, and uptime even when the entity is excluded from the normal user interface. The patch explicitly adds a privacy check before returning this information.
Ransom-note views, search results, and API endpoints were similarly missing consistent filtering. The fix introduces normalized private-group identifiers and alias handling, then rejects or filters notes associated with private groups before returning them to unauthorized callers.
An attacker can exploit the issue remotely without authentication or user interaction, resulting in disclosure of information that was explicitly intended to be restricted to authorized users.
Executive ViewAI
RansomLook, an open-source platform used by security teams to monitor ransomware threats, contains a critical flaw that exposes private threat intelligence to unauthenticated remote access, including sensitive data about tracked threat actors and operational information marked confidential. This vulnerability undermines the confidentiality of your threat monitoring program and could expose which ransomware groups your organization actively investigates to external parties. Immediate patching is required to restore data protection.
Apply vendor patch (commit dc92d6d). If immediate patching is not possible, restrict network access to RansomLook to trusted internal networks only and disable public API exposure until the patch can be deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ransomlook
View allSensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of t
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/g
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the sec
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets thr
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side reque
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read a
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to
Exploit-DB