Suggestarr
Monthly
SuggestArr deployments running in 'local_bypass' authentication mode can be tricked into granting a full administrative session without any credentials by spoofing the X-Forwarded-For header. Because api_service/app.py applies ProxyFix(x_for=1) and enforce_authentication() in api_service/auth/middleware.py trusts the resulting request.remote_addr, a remote attacker who can reach the instance can set X-Forwarded-For to a trusted CIDR value such as 127.0.0.1 and be automatically logged in as an admin via _load_bypass_user_context(), exposing endpoints like /api/users and /api/jobs. The CVSS 4.0 vector is unauthenticated (PR:N) with high confidentiality and integrity impact; exploitation is conditional on the non-default combination of local_bypass being enabled and the app sitting behind a reverse proxy, and no public exploit code or CISA KEV entry was identified at time of analysis.
SuggestArr deployments running in 'local_bypass' authentication mode can be tricked into granting a full administrative session without any credentials by spoofing the X-Forwarded-For header. Because api_service/app.py applies ProxyFix(x_for=1) and enforce_authentication() in api_service/auth/middleware.py trusts the resulting request.remote_addr, a remote attacker who can reach the instance can set X-Forwarded-For to a trusted CIDR value such as 127.0.0.1 and be automatically logged in as an admin via _load_bypass_user_context(), exposing endpoints like /api/users and /api/jobs. The CVSS 4.0 vector is unauthenticated (PR:N) with high confidentiality and integrity impact; exploitation is conditional on the non-default combination of local_bypass being enabled and the app sitting behind a reverse proxy, and no public exploit code or CISA KEV entry was identified at time of analysis.