CVE-2026-111644 in Misaka Danmu Server
Summary
by MITRE • 10/16/2026
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The Misaka Danmu Server software versions up to 2.8.9 suffer from a critical missing authentication vulnerability within its web application interface. This flaw stems from an improper implementation of access control mechanisms on several administrative endpoints located under the /api/ui path. Specifically, routes designated for audit logs, diagnostics, data-check operations, scan-index management, and health checks fail to enforce the get_current_user dependency required by the framework's authentication middleware. Consequently, these sensitive operational interfaces are exposed without requiring valid credentials or session validation, creating a direct pathway for unauthenticated actors to interact with core server functionalities that should be strictly restricted to authorized administrators.
From a technical perspective, this vulnerability represents a classic case of broken access control where security checks are inconsistently applied across different endpoints within the same application layer. The absence of the get_current_user dependency means that any HTTP request targeting these specific routes is processed without verifying the identity or privileges of the requester. This oversight allows external entities to bypass authentication gates entirely, treating protected administrative functions as public resources. Such a configuration error undermines the fundamental principle of least privilege and exposes internal server states and management capabilities to anyone with network connectivity to the service.
The operational impact of this vulnerability is severe due to the breadth of actions an attacker can perform once authenticated access is circumvented. Attackers are able to exfiltrate sensitive information including audit logs which contain login IP addresses, potentially revealing infrastructure topology and user locations. They can also retrieve server logs and environment paths, providing valuable intelligence for further exploitation or lateral movement within a networked environment. Beyond data exposure, the vulnerability allows for destructive actions such as deleting episode rows from the database, clearing media-server mappings that disrupt content delivery, and wiping audit history to cover tracks after an intrusion. These capabilities effectively grant full administrative control over the application's state and integrity without any form of authorization.
This incident aligns with CWE-287 Improper Authentication and CWE-352 Cross-Site Request Forgery if combined with other vectors, but primarily falls under CWE-862 Missing Authorization in many contexts where authentication is assumed to imply authorization or vice versa. In the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through exploitation of public-facing applications (T1190) and enables Data Exfiltration via compromised application interfaces (T1530). The ability to delete data and clear logs also maps to Impact categories such as Data Destruction (T1485) and Defense Evasion by removing evidence (T1070.002).
To mitigate this risk, immediate remediation is required by ensuring that all administrative endpoints under /api/ui enforce strict authentication checks using the get_current_user dependency or an equivalent security middleware component. Developers should conduct a comprehensive audit of route definitions to verify that no internal or management interfaces are inadvertently exposed without proper access controls. Additionally, implementing role-based access control (RBAC) ensures that even if authentication is bypassed in some edge cases, privilege escalation remains restricted based on user roles. Regular penetration testing and static code analysis focused on security middleware integration can help prevent similar oversights in future releases of the Misaka Danmu Server or any comparable web application infrastructure.