CVE-2026-102245 in SurfSense
Summary
by MITRE • 09/29/2026
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
A critical security vulnerability has been identified within MODSetter SurfSense, specifically affecting versions up to 2.0.3. This flaw resides in an unknown function located within the file surfsense_backend/app/routes/circleback_webhook_route.py, which is part of the circleback Endpoint component. The nature of this weakness represents a significant failure in access control mechanisms, allowing for missing authentication during critical operations. Because the vulnerability exists on a webhook route, it likely impacts endpoints designed to receive automated data or commands from external services, making its exploitation particularly dangerous as these routes are often exposed to network traffic without rigorous internal verification if misconfigured.
The technical flaw centers on an insufficient check of user credentials or session validity before processing requests directed at the specified webhook endpoint. In a properly secured application, any request interacting with sensitive backend logic must undergo strict authentication and authorization checks. However, in this instance, the absence of such validation allows unauthenticated actors to interact directly with the underlying functionality. This bypasses standard security controls that would normally restrict access to authorized users or trusted systems only. The vulnerability aligns closely with CWE-287, which describes Improper Authentication, as well as CWE-306, Missing Authentication for Critical Function, highlighting a fundamental breakdown in verifying the identity of the requester before granting access to protected resources.
The operational impact of this vulnerability is severe due to its remote exploitability. Attackers can launch attacks from any location with network connectivity to the target system without requiring prior authentication or local access. The fact that an exploit has already been made publicly available significantly elevates the risk profile, as it lowers the barrier for entry for threat actors who may lack advanced technical skills but possess automated scanning tools. Successful exploitation could lead to unauthorized data manipulation, information disclosure, or potentially further compromise of the underlying infrastructure depending on what actions are permitted through this unauthenticated endpoint. This scenario is consistent with ATT&CK technique T1078, Valid Accounts, although in this case, it involves bypassing account requirements entirely rather than stealing credentials, and may also relate to T1190, Exploit Public-Facing Application, given the remote nature of the attack vector.
The vendor's lack of response to early disclosure attempts exacerbates the situation for existing users who remain exposed to active threats without an official patch or mitigation guidance from MODSetter. In such cases where vendor remediation is delayed or unavailable, organizations must rely on compensating controls to reduce their risk exposure. Immediate steps should include implementing network-level access control lists that restrict inbound traffic to the affected webhook endpoint only from trusted IP addresses known to be legitimate sources of webhooks. Additionally, deploying a Web Application Firewall with rules specifically targeting anomalous requests to this route can provide an additional layer of defense by blocking unauthenticated attempts or malformed payloads associated with the exploit.
Long-term mitigation requires strict adherence to secure development lifecycle practices that mandate authentication checks on all API endpoints, especially those exposed externally. Organizations running affected versions should prioritize upgrading to a patched version as soon as it becomes available from the vendor. Until then, continuous monitoring of access logs for unusual patterns or unauthorized attempts to interact with the circleback endpoint is essential. Security teams should also review their overall webhook implementation strategy to ensure that future integrations include robust signature verification and authentication mechanisms to prevent similar bypasses in other parts of the application architecture.