{"id":"CVE-2026-111643","kind":"vulnerability","aliases":["CVE-2026-111643"],"related":[],"title":"Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated…","description":"Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.","summary":"Misaka Danmu Server <= 2.8.9 (self-hosted danmaku server) applies auth per endpoint, and several /api/ui routers have none. POST /api/ui/config-history/rollback takes an arbitrary key/value and upserts it into config with no login. An attacker sets ipWhitelist to their own /32, and check_ip_whitelist then treats them as admin on every protected endpoint. Trusted proxies and webhookApiKey can also be changed. Routers are registered by default. Other unauthenticated endpoints leak audit and server logs, list the library, and delete rows or clear audit logs.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"misaka_danmu_server","fixed":[],"affected":"<= 2.8.9","ecosystem":"github"}],"ecosystems":[],"tags":["authentication-bypass","docker","misaka-danmu-server","other","self-hosted"],"not_affected_if":["behind-vpn","not-internet-exposed","version-above-2.8.9"],"how_to_check":"Run: curl -i -X POST http://HOST:7768/api/ui/config-history/rollback -H 'Content-Type: application/json' -d '{}'. A 200 with {\"message\":\"key is required\"} means the endpoint is open (an empty key writes nothing); 401/403 means it is protected. Also check the version (<= 2.8.9). Review the config table for unexpected ipWhitelist, trustedProxies or webhookApiKey values, and GET /api/ui/config-history for rollback entries.","fix":"No fixed version published as of 2026-10-23 (2.8.9 is the latest release). Until one exists: do not expose the port to the internet or untrusted LANs, and put it behind a reverse proxy or VPN that blocks /api/ui/config-history, /api/ui/audit, /api/ui/diagnostics and /api/ui/data-check. If exposed, check ipWhitelist and rotate the admin password, API tokens and webhookApiKey. Watch the GitHub releases page.","status":"open","published_at":"2026-10-16T18:17:45+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:05:03+00:00","updated_at":"2026-10-23T23:31:01+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:05:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","impact":"high","summary":"Misaka Danmu Server through 2.8.9 has an unauthenticated endpoint, POST /api/ui/config-history/rollback, that lets anyone write arbitrary configuration keys. An attacker can add their own address to the IP whitelist or change trusted proxies and the webhook API key, then reach every protected endpoint as the administrator.","category":"other","who_cares":["misaka-danmu-server","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker gains full administrator access to the server","analyst_note":"Sources give only the NVD record; confirm the fixed version and whether the endpoint is exposed by default at the project's release notes or GitHub repository.","how_to_check":"Check the installed version: anything 2.8.9 or earlier is in range. Send an unauthenticated POST to /api/ui/config-history/rollback on your instance and see whether it is rejected.\nunknown","needs_analyst":true,"not_affected_if":["version-above-2.8.9"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000487,"input_tokens":2801,"output_tokens":414,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give only the NVD record; confirm the fixed version and whether the endpoint is exposed by default at the project's release notes or GitHub repository.","search":"'-111643':16A,19A '-2026':15A,18A '/32':75B,154C '/api/ui':50B '/api/ui/config-history/rollback':55B,143C '2.8.9':5A,38B,124C 'access':162C 'address':155C 'admin':84B 'administr':168C 'allow':12A,131C 'also':94B 'alter':157C 'appli':44B 'arbitrari':58B,136C 'attack':69B,133C,145C 'audit':106B,118B 'auth':45B 'authent':8A,24B,127C 'authentication-bypass':23B 'bypass':9A,25B,128C 'chang':96B 'check':77B 'clear':117B 'config':64B 'configur':137C 'contain':6A,125C 'cve':14A,17A 'danmaku':42B 'danmu':2A,21A,29B,36B,121C 'default':101B 'delet':114B 'docker':26B 'endpoint':47B,88B,104B,144C,165C 'everi':86B,163C 'host':34B,41B 'ip':78B 'ipwhitelist':71B,149C 'key':138C,150C 'key/value':59B 'leak':105B 'librari':112B 'list':110B 'log':109B,119B 'login':67B 'misaka':1A,20A,28B,35B,120C 'misaka-danmu-serv':27B 'none':53B 'per':46B 'post':54B,142C 'protect':87B,164C 'proxi':90B 'regist':99B 'router':51B,97B 'row':115B 'self':33B,40B 'self-host':32B,39B 'server':3A,22A,30B,37B,43B,108B,122C 'set':70B,147C 'sever':49B 'take':56B 'treat':81B 'trust':89B 'trustedproxi':158C 'unauthent':13A,103B,132C 'unprotect':141C 'upsert':61B 'via':139C 'vulner':10A,129C 'webhookapikey':92B,160C 'whitelist':79B 'write':135C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111643","severity":null,"published_at":"2026-10-16T18:17:45+00:00","modified_at":"2026-10-23T17:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111643:459","url":null,"severity":null,"published_at":"2026-10-23T23:31:01+00:00","modified_at":"2026-10-23T23:31:01+00:00","first_seen_at":"2026-10-23T23:31:01+00:00","fetched_at":"2026-10-23T23:31:01+00:00","note":"Read VulnCheck advisory and researcher write-up (source-derived, not executed). No fixed release found: v2.8.9 (22 Aug) is the latest on the GitHub releases page; no vendor advisory seen. No public working exploit, no exploitation reports; x/social not searched (obscure project)."}],"documents":[{"id":2014,"url":"https://www.vulncheck.com/advisories/misaka-danmu-server-through-2.8.9-authentication-bypass-via-config-history-rollback","title":"VulnCheck: Misaka Danmu Server <= 2.8.9 auth bypass via config-history rollback","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2018,"url":"https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication","title":"hieuPenguinnn: unauthenticated /api/ui endpoints and arbitrary config write (source-derived, not executed)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2019,"url":"https://github.com/l429609201/misaka_danmu_server/releases","title":"misaka_danmu_server releases (latest listed: v2.8.9)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}