Authentication bypass in Misaka Danmu Server via config rollback
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Misaka Danmu Server from l429609201 through 2.8.9 has an authentication bypass caused by missing authentication (CWE-306) on the POST /api/ui/config-history/rollback endpoint. An unauthenticated remote attacker can write arbitrary configuration keys through this endpoint. By setting the ipWhitelist, trustedProxies or webhookApiKey keys, the attacker gains access to every protected endpoint as the administrator.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| l429609201 | misaka_danmu_server | up to 2.8.9 | — | No fix listed | CNA |
- misaka_danmu_server Vendorl429609201 Affected up to 2.8.9 Fixed in — No fix listed CNA
Remediation
No fixed version is listed for Misaka Danmu Server.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111643
- 2026-10-16 Alias added: GHSA-h9w3-vw4p-h6vw
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: MEDIUM → HIGH
References
More l429609201 vulnerabilities
- TI-2026-75430 Missing authentication on /api/ui routes in Misaka Danmu Server CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-111643 · CVE Program
- CVE-2026-111643 · NVD
- FIRST EPSS
- GHSA-h9w3-vw4p-h6vw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences