CVE-2026-119598 in Miaomiaowu
Summary
by MITRE • 10/30/2026
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external_subscription_id parameter to disclose override scripts, filter rules, custom request headers and health-check URLs.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The Miaomiaowu application prior to version 0.9.3 suffers from a critical insecure direct object reference vulnerability within its API endpoint for managing proxy provider configurations. This flaw resides in the /api/user/proxy-provider-configs route, which is designed to handle requests related to user-specific settings such as override scripts, filter rules, custom request headers, and health-check URLs. The underlying technical deficiency lies in the server-side logic that processes these configuration management requests without implementing adequate access control checks or object-level authorization mechanisms. Specifically, the application relies on a global auto-incrementing external_subscription_id parameter to identify specific configuration records. Because this identifier is sequential and predictable, it fails to obscure the identity of the resource being accessed, allowing any authenticated user to manipulate the input value directly.
From an operational perspective, this vulnerability enables unauthorized data disclosure across different user accounts within the system. An attacker who has valid authentication credentials can exploit this flaw by systematically iterating through values of the external_subscription_id parameter. By incrementing or decrementing this identifier in their HTTP requests, they can traverse the database records belonging to other users. This process allows the attacker to retrieve sensitive configuration data that should be strictly isolated per user account. The disclosed information includes override scripts which may contain custom logic for traffic routing, filter rules used for content blocking or modification, custom request headers that might expose internal authentication tokens or API keys, and health-check URLs that could reveal infrastructure details such as IP addresses or domain names associated with the victim's proxy services.
This type of vulnerability is formally classified under CWE-639, which describes Insecure Direct Object References where a web application exposes a reference to an internal implementation object, such as a file, directory, or database key, without proper access control checks. The exploitation technique aligns closely with the ATT&CK framework's T1078 valid accounts tactic and specifically relates to data exfiltration methods that leverage broken access controls to retrieve sensitive information from other entities within the same system. The impact is significant as it compromises the confidentiality of user configurations, potentially leading to further security breaches if those configurations contain credentials or expose network topology details that can be leveraged for targeted attacks against the victim's infrastructure.
To mitigate this vulnerability, developers must implement robust object-level authorization checks on all API endpoints that handle sensitive resources. The application should verify that the authenticated user initiating the request is the legitimate owner of the resource identified by the external_subscription_id parameter before returning any data. Additionally, relying solely on auto-incrementing integer identifiers for security-sensitive operations is discouraged; using universally unique identifiers such as UUIDs can make enumeration significantly more difficult, although it does not replace the need for proper access control validation. Input validation should also be enforced to ensure that only expected formats and ranges of IDs are processed, reducing the attack surface associated with parameter manipulation. Regular security audits and penetration testing focusing on broken access controls are essential to identify and remediate such flaws before they can be exploited in production environments.