CVE-2026-55835 Details
Description
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.
A denial-of-service vulnerability has been identified in Lookyloo versions prior to 1.39.4. The issue arises in the 'report a capture' feature, where an unauthenticated user can manipulate the '/json/<uuid>/report' API endpoint. The endpoint incorrectly handles the 'email' and 'comment' parameters, causing the 'as_admin' parameter to be misconfigured. When 'as_admin' is set to True, it triggers a search query on a connected MISP instance, potentially leading to a denial-of-service condition on that instance.
Users can update to Lookyloo version 1.39.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082 | [email protected] | Source CodeVendor |
| https://github.com/Lookyloo/lookyloo/pull/1330 | [email protected] | Source CodeVendor |
| https://github.com/Lookyloo/lookyloo/releases/tag/v1.39.4 | [email protected] | Release NotesVendor |
| https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-66gj-hmcp-5cfj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-233 | Improper Handling of Parameters | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lookyloo | <= 1.39.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |