Misaka Danmu Server
Monthly
Unauthenticated configuration write in Misaka Danmu Server 2.8.9 and earlier allows remote attackers to bypass authentication entirely and gain administrative access by abusing the unprotected POST /api/ui/config-history/rollback endpoint. An attacker can write arbitrary configuration keys, such as setting ipWhitelist to their own /32 address, modifying trustedProxies, or altering webhookApiKey, which then grants access to every protected endpoint as the administrator. The flaw carries a critical severity rating (CVSS 4.0 base score 9.3; independent assessment confirms a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires only network reachability of the web API - no authentication, user interaction, or non-default configuration is needed. No public exploit identified at time of analysis.
Unauthenticated access to the administrative /api/ui surface of Misaka Danmu Server through 2.8.9 allows any attacker who can reach the HTTP service to read audit logs containing login IP addresses, server logs and environment paths, and to delete episode rows, clear media-server mappings, and wipe audit history. The audit, diagnostics, data-check, scan-index and health route modules ship without the get_current_user dependency, so a default deployment applies no authentication to them whatsoever (CWE-306). The reported CVSS 4.0 score is 6.9, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) concurs that this is a genuine but moderate-priority issue rather than an inflated critical one; the realistic limiting factor is exposure, since Misaka Danmu Server is self-hosted and normally confined to a LAN or fronted by a reverse proxy. There is no CISA KEV entry and no public exploit code identified at time of analysis, so exploitation is opportunistic and requires direct network reachability of the affected endpoints.
Unauthenticated configuration write in Misaka Danmu Server 2.8.9 and earlier allows remote attackers to bypass authentication entirely and gain administrative access by abusing the unprotected POST /api/ui/config-history/rollback endpoint. An attacker can write arbitrary configuration keys, such as setting ipWhitelist to their own /32 address, modifying trustedProxies, or altering webhookApiKey, which then grants access to every protected endpoint as the administrator. The flaw carries a critical severity rating (CVSS 4.0 base score 9.3; independent assessment confirms a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires only network reachability of the web API - no authentication, user interaction, or non-default configuration is needed. No public exploit identified at time of analysis.
Unauthenticated access to the administrative /api/ui surface of Misaka Danmu Server through 2.8.9 allows any attacker who can reach the HTTP service to read audit logs containing login IP addresses, server logs and environment paths, and to delete episode rows, clear media-server mappings, and wipe audit history. The audit, diagnostics, data-check, scan-index and health route modules ship without the get_current_user dependency, so a default deployment applies no authentication to them whatsoever (CWE-306). The reported CVSS 4.0 score is 6.9, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) concurs that this is a genuine but moderate-priority issue rather than an inflated critical one; the realistic limiting factor is exposure, since Misaka Danmu Server is self-hosted and normally confined to a LAN or fronted by a reverse proxy. There is no CISA KEV entry and no public exploit code identified at time of analysis, so exploitation is opportunistic and requires direct network reachability of the affected endpoints.