CVE-2026-113703 Details

An authentication bypass vulnerability has been identified in SuggestArr versions prior to 3.0.0. The issue arises in the local_bypass authentication mode, where the function enforce_authentication() in api_service/auth/middleware.py improperly trusts the client-controlled request.remote_addr value. This value is derived from the easily spoofable X-Forwarded-For header, due to the ProxyFix(x_for=1) configuration in api_service/app.py. Exploiting this vulnerability, attackers can send requests with X-Forwarded-For set to a trusted CIDR address, such as 127.0.0.1, to gain an unauthenticated admin session through _load_bypass_user_context(). This exploitation grants full administrative access to endpoints like /api/users and /api/jobs, without the need for any credentials.

Users are advised to update SuggestArr to version 3.0.0 or later, where this vulnerability has been patched.