Ransomlook EUVD-2026-64856

No authentication is required per the CVSS 4.0 PR:N metric. The attacker needs network-level HTTP access to the Ransomlook API. The primary disclosure path (/api/health/<name>) is triggered when the supplied name does not match any known group or market, activating the pre-patch fallback that passed the raw caller string into the Redis SCAN MATCH expression - submitting a glob wildcard such as * or Secret* is sufficient. Exploitation of /api/crypto/chain/<chain> follows the same pattern. Exploitation of the delete_manual_torrent() path with integrity impact is additionally constrained: attacker-controlled input must reach that internal function, implying potential additional access controls; the CVSS VI:N assessment suggests this path is not directly reachable by unauthenticated external actors under default deployment, though the exact access boundary is not fully specified in available data and should be verified with the vendor.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9) reflects a remotely exploitable, unauthenticated, low-complexity flaw with limited confidentiality impact and no assessed integrity or availability impact. No EPSS score is included in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept has been identified. The delete_manual_torrent() sink is flagged in the description as potentially destructive - a crafted infohash with glob metacharacters could match torrent-health keys belonging to other torrents - yet the CVSS vector assigns VI:N, suggesting the vendor assessed that attacker-controlled input reaching that function is constrained by additional application-level access controls not fully described in available data; this discrepancy should be verified with the vendor. Overall real-world impact is primarily unauthorized read enumeration of private group metadata rather than data modification or service disruption, and the limited deployment footprint of Ransomlook further bounds aggregate exposure - even a small municipal IT security team that self-hosts an instance in a city like bytom would face manageable risk if network access to the API is restricted pending patching.

An unauthenticated attacker sends an HTTP GET request to /api/health/* on a publicly accessible Ransomlook instance running an unpatched version; because the asterisk does not resolve to a known group, the pre-patch fallback interpolates the literal * into the Redis SCAN pattern health:*:*, causing Redis to return health records for every tracked entity including private groups. No public exploit code exists, but exploitation requires only a standard HTTP client and awareness of the endpoint structure, which is fully derivable from the open-source codebase on GitHub.