reNgine EUVD-2026-80816

Exploitation requires an authenticated account on the target reNgine instance (through version 2.2.0), specifically a low-privilege Auditor role or higher - this is the primary limiting factor (PR:L). Once authenticated, the attacker needs only network access to the GetFileContents API endpoint; no user interaction, no elevated privileges, and no non-default configuration are required, since the endpoint lacks role-based permission checks by design in the affected versions. The disclosure is meaningful only when the instance has third-party integrations configured (SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, Hunter API keys stored in bundled config files); an instance with no such keys populated has less to expose.

This is a well-calibrated medium-to-high severity issue driven by information disclosure, not a critical RCE. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: a low-privileged authenticated user (PR:L, mapping to the Auditor role) reads sensitive files over the network with no user interaction. The 7.1 score is appropriate - confidentiality-only impact (VC:H, VI:N, VA:N) because the flaw exposes third-party API keys but does not directly modify or destroy data. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The key limiter is PR:L: the attacker must already hold a valid low-privilege account, which reduces mass-exploitation likelihood versus a pre-auth flaw. However, the real-world blast radius is amplified because the disclosed secrets (SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, Hunter API keys) enable lateral abuse of paid third-party accounts and further reconnaissance - the impact extends beyond reNgine itself even though CVSS scope/subsequent-system metrics are marked N. Priority should be elevated for any multi-tenant or shared reNgine deployment where untrusted users hold Auditor roles.

An attacker granted a low-privilege Auditor account on a shared reNgine instance (through 2.2.0) sends a crafted request to the GetFileContents API endpoint requesting a bundled tool configuration file. Because the endpoint performs no role-based permission check, it returns the file contents containing third-party API keys (Shodan, Censys, VirusTotal, etc.), which the attacker exfiltrates and reuses to abuse those paid services. No public POC is present in the input, but the vulnerable code paths are referenced directly in the vendor advisory and GitHub source lines.