{"id":"CVE-2026-55835","kind":"vulnerability","aliases":["CVE-2026-55835"],"related":[],"title":"Lookyloo: unauthenticated report endpoint can trigger MISP searches, risking denial of service","description":"Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's \"report a capture\" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.","summary":"Lookyloo, a web tool that captures a website and maps the domains it calls, has a report API endpoint that mishandles its parameters. An unauthenticated user can force an admin-only search against a configured MISP instance, which can overload that MISP server.","severity":"medium","cvss":6.9,"epss":0.00315,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lookyloo","misp","package","self-hosted"],"not_affected_if":["no-misp-configured","version-1.39.4-or-later"],"how_to_check":"- Check the installed Lookyloo version; versions before `1.39.4` are affected.\n- Check whether a MISP instance is configured in Lookyloo; the sources do not say how to confirm this beyond the configuration.","fix":"- Upgrade Lookyloo to `1.39.4` or later.","status":"open","published_at":"2026-10-23T05:17:15+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:38:37+00:00","updated_at":"2026-10-25T03:38:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:38:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Lookyloo to `1.39.4` or later.","reach":"internet","title":"Lookyloo: unauthenticated report endpoint can trigger MISP searches, risking denial of service","impact":"low","summary":"Lookyloo, a web tool that captures a website and maps the domains it calls, has a report API endpoint that mishandles its parameters. An unauthenticated user can force an admin-only search against a configured MISP instance, which can overload that MISP server.","category":"package","nicknames":[],"who_cares":["lookyloo","self-hosted","misp"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated requests overload the configured MISP instance with searches","analyst_note":"","how_to_check":"- Check the installed Lookyloo version; versions before `1.39.4` are affected.\n- Check whether a MISP instance is configured in Lookyloo; the sources do not say how to confirm this beyond the configuration.","needs_analyst":false,"not_affected_if":["version-1.39.4-or-later","no-misp-configured"],"who_is_affected":"Lookyloo instances below version 1.39.4 that are reachable by others, particularly ones that have a MISP instance configured for searches. The sources say the search only happens when MISP is configured, so instances without MISP are unlikely to be meaningfully exposed. Self-hosted analysts running Lookyloo privately can treat this as low urgency.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":3486,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-55835':15A,18A '/json':114C '/report':115C '1.39.4':96C,187C 'add':146C 'admin':55B,129C,133C 'admin-on':54B 'allow':75C 'analyst':158C 'api':42B,116C 'call':38B,90C 'captur':30B,78C,106C 'capturereport':118C 'caus':173C 'comment':125C 'configur':60B,144C 'could':171C 'cve':13A,16A 'demand':109C 'denial':10A 'display':84C 'domain':36B,88C 'dos':175C 'email':107C,123C,154C 'endpoint':4A,43B,117C 'expect':112C 'forc':52B 'host':24B 'incorrect':120C 'inform':169C 'instanc':62B,142C,179C 'interfac':73C 'issu':181C 'leak':168C 'list':148C 'lookyloo':1A,19B,25B,69C,102C 'map':34B 'match':150C 'mishandl':45B 'misp':7A,20B,61B,67B,141C,178C 'overload':65B 'overwrit':127C 'packag':21B 'page':81C 'paramet':47B,126C 'pass':121C 'patch':184C 'potenti':172C 'prior':93C 'queri':138C 'report':3A,41B,104C 'risk':9A,166C 'search':8A,57B,137C 'self':23B 'self-host':22B 'sent':155C 'server':68B 'servic':12A 'submitt':161C 'tool':28B 'tree':86C 'trigger':6A,101C,135C 'true':131C 'unauthent':2A,49B,98C 'url':151C 'user':50B,76C,99C 'version':95C,186C 'web':27B,72C 'websit':32B,80C","nicknames":[],"mitigations":[],"who_affected":"Lookyloo instances below version 1.39.4 that are reachable by others, particularly ones that have a MISP instance configured for searches. The sources say the search only happens when MISP is configured, so instances without MISP are unlikely to be meaningfully exposed. Self-hosted analysts running Lookyloo privately can treat this as low urgency.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T05:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55835","severity":null,"published_at":"2026-10-23T05:17:15+00:00","modified_at":"2026-10-23T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-55835","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55835","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}