Live › vulnerability › CVE-2026-119598
Miaomiaowu before 0.9.3 fails to check ownership on the /api/user/proxy-provider-configs endpoint. A logged-in user can iterate a sequential ID to read other users' override scripts, filter rules, custom headers and health-check URLs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams that self-host Miaomiaowu with multiple user accounts are exposed, because any logged-in user can read other users' configurations by changing an ID. A single-user instance has no other users' data to expose. unknown whether managed hosting is in scope.
No product ranges from the sources yet.
0.9.3/api/user/proxy-provider-configs is reachable by non-admin accounts0.9.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external_subscription_id parameter to disclose override scripts, filter rules, custom request headers and health-check URLs.
This page as .md · .json · in your agent: get_signal("CVE-2026-119598")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.