CVE-2026-111643 Details

A vulnerability allowing authentication bypass has been identified in Misaka Danmu Server versions through 2.8.9. This issue arises from the absence of authentication on the POST /api/ui/config-history/rollback endpoint, which allows unauthenticated attackers to write arbitrary configuration keys. Exploitation of this vulnerability enables attackers to set the ipWhitelist key to their own address, or modify other keys such as trustedProxies and webhookApiKey. As a result, attackers can access all protected endpoints as an administrator.

To address this vulnerability, add authentication to the affected endpoint and implement a configuration key allowlist to prevent security-sensitive keys from being modified. Additionally, consider applying a router-level authentication dependency to ensure all endpoints are properly secured.