CVE-2026-7042 Details

A critical vulnerability has been identified in 666ghj MiroFish versions through 0.1.2, where over 50 REST API endpoints lack any authentication or authorization. This flaw, located in the 'create_app' function within 'backend/app/__init__.py', allows remote access to all endpoints, including those that perform destructive actions such as deleting projects, reports, and terminating simulation processes. The absence of authentication middleware or identity verification means that any network-reachable client can exploit this vulnerability, leading to unauthorized access and manipulation of critical application functions.

As an immediate fix, implement API key authentication middleware in the Flask application. This can be done by creating a decorator that checks for a valid API key in the request headers and applying it to all routes.