Read the docs
TI-2026-74111 Aliases CVE-2026-110617GHSA-h2vr-gxjh-m386

we-mp-rss Missing Authorization via Export File Download Endpoint

Priority MEDIUM 61CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

we-mp-rss through 1.5.3 by rachelos contains a missing authorization vulnerability (CWE-862) in the /api/v1/wx/tools/export/download endpoint. Its authentication dependency is commented out, so unauthenticated remote attackers can download export archives stored under data/docs by supplying an mp_id and a guessable timestamp-based filename. Attackers can also set delete_after_download to true to delete the archives after download. A public proof of concept is reported in CISA SSVC data.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00644 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
racheloswe-mp-rssup to 1.5.3—No fix listedCNA
  • we-mp-rss Vendorrachelos Affected up to 1.5.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for we-mp-rss.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110617
  2. 2026-10-14 Alias added: GHSA-h2vr-gxjh-m386
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 2

  • TI-2026-75473 Eval injection in WeRSS RSS endpoint allows remote code execution CVSS 4.0CRITICAL 9.3
  • TI-2026-01863 rachelos WeRSS we-mp-rss JWT auth.py default key CVSS 4.0MEDIUM 6.3
  • TI-2026-01864 rachelos WeRSS we-mp-rss tools.py download_export_file path traversal CVSS 4.0MEDIUM 5.3
  • TI-2025-12044 rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery CVSS 4.0MEDIUM 5.3
  • TI-2026-02427 rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences