Live › vulnerability › CVE-2026-111626
Go to dashboardWebreaper Damselfly through version 4.5.3 has its API controller authorization attributes commented out, so /api/* routes are reachable without logging in. An unauthenticated attacker can create an administrator account or reset any user's password and take full control of the instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
4.5.3 or earlier is affected); unknown whether a config setting can check the exposure furtherRotate passwords and review user accounts for unexpected administrators if exposure is suspected.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
This page as .md · .json · in your agent: get_signal("CVE-2026-111626")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.