Miaomiaowu
Monthly
Cross-user information disclosure in Miaomiaowu before 0.9.3 allows any authenticated user to read other users' proxy-provider configurations by iterating the global auto-increment external_subscription_id value supplied to /api/user/proxy-provider-configs. Exposed fields include override scripts, filter rules, custom request headers and health-check URLs, so leaked headers may carry upstream credentials. The flaw requires a valid low-privileged account (PR:L) and only matters on multi-user deployments where accounts share an instance; a public write-up describing the enumeration approach exists, though it is not confirmed as working exploit code, and no CISA KEV entry or EPSS signal was supplied, keeping this at a moderate, prioritize-this-month severity rather than an emergency.
Cross-user information disclosure in Miaomiaowu before 0.9.3 allows any authenticated user to read other users' proxy-provider configurations by iterating the global auto-increment external_subscription_id value supplied to /api/user/proxy-provider-configs. Exposed fields include override scripts, filter rules, custom request headers and health-check URLs, so leaked headers may carry upstream credentials. The flaw requires a valid low-privileged account (PR:L) and only matters on multi-user deployments where accounts share an instance; a public write-up describing the enumeration approach exists, though it is not confirmed as working exploit code, and no CISA KEV entry or EPSS signal was supplied, keeping this at a moderate, prioritize-this-month severity rather than an emergency.