{"id":"CVE-2026-111644","kind":"vulnerability","aliases":["CVE-2026-111644"],"related":[],"title":"Misaka Danmu Server: unauthenticated admin routes delete data, wipe audit logs","description":"Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.","summary":"Misaka Danmu Server through 2.8.9 exposes audit, diagnostics, data-check, scan-index and health routes under /api/ui without the authentication check. An unauthenticated attacker can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings and wipe audit history.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["misaka-danmu-server","other","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed version is `2.8.9` or earlier.\n- Request the /api/ui audit, diagnostics or health routes without credentials and see whether they return data.","fix":null,"status":"open","published_at":"2026-10-16T18:17:45+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:27:38+00:00","updated_at":"2026-10-25T03:27:38+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:27:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Misaka Danmu Server: unauthenticated admin routes delete data, wipe audit logs","impact":"medium","summary":"Misaka Danmu Server through 2.8.9 exposes audit, diagnostics, data-check, scan-index and health routes under /api/ui without the authentication check. An unauthenticated attacker can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings and wipe audit history.","category":"other","nicknames":[],"who_cares":["misaka-danmu-server","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads login IPs and deletes media data unauthenticated","analyst_note":"","how_to_check":"- Check the installed version is `2.8.9` or earlier.\n- Request the /api/ui audit, diagnostics or health routes without credentials and see whether they return data.","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Any deployment running Misaka Danmu Server `2.8.9` or earlier whose /api/ui routes are reachable by someone who should not have admin visibility. The sources do not say which network exposure or configuration is required, so unknown whether a private-only instance is safe.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.0011,"input_tokens":3354,"output_tokens":1529,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111644':14A,17A '-2026':13A,16A '/api/ui':44B,104C '2.8.9':30B,80C 'access':91C 'admin':5A 'allow':87C 'attack':51B,89C,111C 'audit':10A,32B,54B,74B,92C,114C,134C 'authent':47B,84C 'check':36B,48B,96C 'clear':67B,127C 'contain':81C 'current':108C 'cve':12A,15A 'danmu':2A,20B,27B,77C 'data':8A,35B,95C 'data-check':34B,94C 'delet':7A,64B,124C 'depend':110C 'diagnost':33B,93C 'environ':62B,122C 'episod':65B,125C 'expos':31B 'get':107C 'health':41B,101C 'histori':75B,135C 'host':25B 'index':39B,99C 'ip':58B,118C 'lack':105C 'log':11A,55B,60B,115C,120C 'login':57B,117C 'map':71B,131C 'media':69B,129C 'media-serv':68B,128C 'misaka':1A,19B,26B,76C 'misaka-danmu-serv':18B 'miss':83C 'path':63B,123C 'read':53B,113C 'rout':6A,42B,102C 'row':66B,126C 'scan':38B,98C 'scan-index':37B,97C 'self':24B 'self-host':23B 'server':3A,21B,28B,59B,70B,78C,119C,130C 'unauthent':4A,50B,88C 'user':109C 'vulner':85C 'wipe':9A,73B,133C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Any deployment running Misaka Danmu Server `2.8.9` or earlier whose /api/ui routes are reachable by someone who should not have admin visibility. The sources do not say which network exposure or configuration is required, so unknown whether a private-only instance is safe.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111644","severity":null,"published_at":"2026-10-16T18:17:45+00:00","modified_at":"2026-10-21T21:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}