CVE-2026-110617 Details
Description
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.
A missing authorization vulnerability has been identified in the we-mp-rss application, specifically in versions through 1.5.3. The issue resides in the export download API endpoint, which is accessible without authentication. This vulnerability allows unauthenticated attackers to download export archives by supplying a valid mp_id and a timestamp-based filename, which can be guessed. The downloaded files are stored under data/docs, and attackers can also request the deletion of these files after download.
The export download endpoint should be modified to require authentication and authorization. Implement checks to ensure that the user has the right to access the requested mp_id and export file. Additionally, remove the option for unauthenticated deletion of files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGl | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://github.com/rachelos/we-mp-rss | [email protected] | Source CodeVendor |
| https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/tools.py#L321-L376 | [email protected] | Source CodeVendor |
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGl | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/we-mp-rss-through-1.5.3-missing-authorization-via-export-file-download-endpoint | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| we-mp-rss | <= 1.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |