EUVD-2026-80816
GHSA-29ch-4262-w3fr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-privilege user (PR:L) reads sensitive config over network (AV:N) with no interaction; confidentiality-only (C:H), no integrity/availability impact, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.
AnalysisAI
reNgine through 2.2.0 allows any authenticated user, including low-privilege Auditor accounts, to read bundled recon-tool configuration files through the GetFileContents API endpoint without role-based permission checks. Those files can contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter, making this an information-disclosure issue rather than remote code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account on the target reNgine instance (through version 2.2.0), specifically a low-privilege Auditor role or higher - this is the primary limiting factor (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a well-calibrated medium-to-high severity issue driven by information disclosure, not a critical RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified in the provided data, so monitor upstream issue https://github.com/yogeshojha/rengine/issues/1554 and the VulnCheck advisory https://www.vulncheck.com/advisories/rengine-through-2.2.0-unauthorized-configuration-file-read for an official fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all reNgine through 2.2.0 deployments, restrict network access to trusted administrators, disable or remove Auditor accounts where not essential, and immediately rotate any configured API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter; review GetFileContents endpoint logs for anomalous reads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. Rated high severity (CVSS 8.8),
Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function. Rated critical
OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0. Rated critical severity (CVSS 9.8), this vu
Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function
reNgine through 0.5 relies on a predictable directory name. Rated critical severity (CVSS 9.8), this vulnerability is re
reNgine is an automated reconnaissance framework for web applications. Rated medium severity (CVSS 5.4), this vulnerabil
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 8.8), this vulnerabilit
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 7.4), this vulnerabilit
reNgine is an automated reconnaissance framework for web applications. Rated medium severity (CVSS 5.3), this vulnerabil
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 8.7), this vulnerabilit
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 7.1), this vulnerabilit
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today