volotat Anagnorisis EUVD-2026-86294

Requires network reachability to the Anagnorisis application's Socket.IO Connect interface (in app.py); the endpoint enforces no authentication, so any remote party that can open a Socket.IO connection can interact with it. No credentials, user interaction, or special configuration are named as prerequisites. The primary practical limiters are exposure (the instance must be network-reachable to the attacker, and many self-hosted deployments sit behind a LAN or reverse proxy) and the narrow deployment footprint of this niche project; impact is further bounded to limited read/modify/disruption per the Low impact metrics. Affected versions are reported as up to 0.3.1/0.4.0, with no vendor-confirmed fixed release.

This is a low-to-moderate real-world risk despite the CVSS 4.0 base of 6.9. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes trivially reachable, remote, unauthenticated exploitation, and CWE-306 (missing authentication) on the Socket.IO Connect interface is a genuine access-control gap - but the impacts are all bounded to Low (VC:L/VI:L/VA:L), meaning limited data exposure, limited state modification, and limited disruption rather than full compromise or RCE. The E:P temporal metric and the 'exploit made public' claim are corroborated by a referenced exploit write-up, so publicly available exploit code exists; however, this is NOT active exploitation - there is no CISA KEV listing and no EPSS score was provided. The dominant limiting factor is prevalence, not difficulty: Anagnorisis is an obscure hobby/self-hosted project, so despite an easy exploit the realistic attacker population and exposed instance count are very small. Data quality is a caveat - this is a single-source VulDB report with a non-responsive vendor and no independently confirmed fixed version, so affected-version and impact details should be treated as unverified. Net: a legitimate finding worth patching for anyone running the software, but not a fleet-wide priority.

An attacker who can reach the application's network port connects directly to the Socket.IO endpoint in app.py without providing any credentials, because authentication is not enforced on the connect interface. From there they can invoke socket events to read or manipulate limited application state or disrupt service. A public exploit write-up exists (referenced note-hxlab share), lowering the skill needed to reproduce it.