Live › vulnerability › CVE-2026-111644
Go to dashboardMisaka Danmu Server through 2.8.9 exposes audit, diagnostics, data-check, scan-index and health routes under /api/ui without the authentication check. An unauthenticated attacker can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings and wipe audit history.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment running Misaka Danmu Server or earlier whose /api/ui routes are reachable by someone who should not have admin visibility. The sources do not say which network exposure or configuration is required, so unknown whether a private-only instance is safe.
2.8.9No product ranges from the sources yet.
2.8.9 or earlier.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.
This page as .md · .json · in your agent: get_signal("CVE-2026-111644")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.