CVE-2026-113703 in SuggestArr
Summary
by MITRE • 10/20/2026
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
SuggestArr versions prior to 3.0.0 are affected by a critical authentication bypass vulnerability rooted in the improper validation of client-supplied network identifiers within its local_bypass authentication mode. The core technical flaw resides in the enforce_authentication function located at api_service/auth/middleware.py, which relies on the request.remote_addr attribute to determine whether an incoming connection originates from a trusted source. This reliance is problematic because the application utilizes Werkzeug's ProxyFix middleware with x_for=1 configuration in api_service/app.py. This specific configuration instructs the framework to trust only the first entry in the X-Forwarded-For header when populating request.remote_addr, rather than validating the entire chain of proxies or ignoring external headers entirely for local bypass logic. Consequently, an attacker can manipulate this value by injecting a trusted IP address into the X-Forwarded-For HTTP header during their initial request to the server.
The operational impact of this vulnerability is severe, as it allows unauthenticated attackers to gain full administrative privileges without presenting valid credentials or tokens. By setting the X-Forwarded-For header to 127.0.0.1, which represents localhost and is typically considered a trusted internal address, the application incorrectly assumes the request originates from an authorized local source. This deception triggers the _load_bypass_user_context function, which automatically assigns administrative privileges to the attacker's session. Once authenticated via this bypass, the adversary gains unrestricted access to sensitive API endpoints such as /api/users and /api/jobs. This level of access enables the modification or deletion of user accounts, manipulation of job queues, potential data exfiltration, and complete compromise of the application's integrity and availability.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where an actor is able to bypass authentication mechanisms by exploiting trust in client-controlled input or network metadata. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker leverages a misconfiguration to assume the identity of an authorized user without possessing legitimate credentials. The root cause is further categorized under CWE-295, Improper Certificate Validation, if viewed through the lens of trusting unverified proxy headers, or more accurately CWE-346, Origin Authentication Misrepresentation, due to the failure to properly validate the true origin of the request against a trusted list while ignoring spoofable transport-layer metadata.
To mitigate this vulnerability, developers must immediately update SuggestArr to version 3.0.0 or later where these issues have been addressed. In interim scenarios or for custom implementations relying on similar patterns, it is imperative to disable ProxyFix when handling local bypass logic or ensure that the middleware does not overwrite request.remote_addr with values derived from X-Forwarded-For if those headers are susceptible to spoofing by external clients. Authentication mechanisms should never rely solely on IP address validation via proxy headers for administrative access control. Instead, implementations should enforce multi-factor authentication and use cryptographically signed tokens or session cookies that cannot be forged through header manipulation. Additionally, network-level controls such as Web Application Firewalls can help detect anomalous patterns of X-Forwarded-For usage from external sources attempting to mimic internal traffic.