TI-2026-75412 CVE-2026-111626 · GHSA-p952-wg9v-vp35
Missing authentication on Webreaper Damselfly REST API controllers
Priority MEDIUM 48
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out.