CVE-2026-111644 Details
Description
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.
A missing authentication vulnerability has been identified in Misaka Danmu Server versions through 2.8.9. This vulnerability allows unauthenticated attackers to access several API routes under '/api/ui' that lack the necessary authentication dependency. The affected routes include audit, diagnostics, data-check, scan-index, and health. Exploitation of this vulnerability enables attackers to read sensitive information such as audit logs (including login IPs), server logs, and environment paths. Additionally, attackers can delete episode rows, clear media-server mappings, and wipe audit history.
Add authentication dependencies to all handlers in 'config_history.py', 'audit.py', 'diagnostics.py', 'data_check.py', 'scan_index.py', 'health.py', 'trends.py', 'calendar_extra.py', 'recognition_check.py', 'ai_explain.py', and the two 'customDanmakuPath' handlers in 'config_extra.py'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Misaka Danmu Server | <= 2.8.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |