Live › vulnerability › CVE-2026-55835
Go to dashboardLookyloo, a web tool that captures a website and maps the domains it calls, has a report API endpoint that mishandles its parameters. An unauthenticated user can force an admin-only search against a configured MISP instance, which can overload that MISP server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Lookyloo instances below version 1.39.4 that are reachable by others, particularly ones that have a MISP instance configured for searches. The sources say the search only happens when MISP is configured, so instances without MISP are unlikely to be meaningfully exposed. Self-hosted analysts running Lookyloo privately can treat this as low urgency.
No product ranges from the sources yet.
1.39.4 are affected.1.39.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-55835")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.