CVE-2026-78387 in RansomLook
Summary
by MITRE • 08/24/2026
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to configuration-management functionality.
An authenticated low-privileged user able to access the endpoint can submit crafted configuration values that are written directly to the application's config/generic.json file. The affected functionality permits modification of configuration sections including notification, LDAP, SMTP, and general application settings. Successful exploitation could therefore allow an attacker to alter security-sensitive application behavior, redirect integrations or notifications, modify authentication-related configuration, disrupt external services, or render the RansomLook installation unavailable.
The configuration editor also operated on a configuration file containing sensitive values such as passwords, tokens, secrets, and API keys. Although the affected version contains logic intended to prevent recognized secret values from being returned to the browser, exposing configuration management through insufficiently authorized web functionality significantly increases the impact of a compromised or low-privileged account.
The patch resolves the issue by completely removing the /admin/config route and associated configuration-editing interface, preventing application configuration from being modified through the web UI.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/24/2026
RansomLook suffers from an authorization weakness within its web-based configuration editor, specifically affecting the endpoint exposed at /admin/config. This vulnerability stems from a failure to enforce proper access control mechanisms for administrative functions. While the endpoint correctly requires an authenticated session to prevent anonymous users from accessing it, it lacks explicit privilege or administrator-level authorization checks. Consequently, any user who possesses valid credentials with low-privileged status can interact with this interface if they know the URL path. This represents a classic Broken Access Control flaw where the application relies on security through obscurity regarding the endpoint location rather than enforcing role-based access controls that restrict configuration modifications to users with elevated privileges only.
The technical exploitation of this vulnerability allows an authenticated low-privileged user to submit crafted configuration values directly into the application's generic.json file located in the config directory. The affected functionality is broad, permitting modification of critical system sections including notification settings, LDAP integration parameters, SMTP server configurations, and general application behaviors. By manipulating these fields, an attacker can fundamentally alter how the RansomLook instance operates. For example, modifying SMTP or notification settings could allow the redirection of alerts to a maliciously controlled email address, thereby disrupting incident response workflows or enabling phishing campaigns using trusted sender identities. Similarly, altering LDAP configurations could potentially bypass authentication mechanisms if specific parameters are manipulated incorrectly during an attack scenario, although the primary impact lies in operational disruption and data integrity compromise.
The severity of this vulnerability is significantly amplified by the nature of the configuration file itself, which stores sensitive security credentials such as passwords, API keys, tokens, and secrets. Although the software includes logic intended to mask or prevent these secret values from being returned to the browser interface when viewed, the ability to write arbitrary data into this file creates substantial risk. An attacker with write access can overwrite existing secure configurations with malicious ones that may exfiltrate data through external callbacks, disable security logging, or introduce backdoors via custom script injections if the configuration parser allows execution of dynamic code. Furthermore, because the application does not validate whether the user has administrative rights before allowing these writes, a compromised low-privileged account becomes a powerful tool for an attacker to escalate their impact on the system's availability and integrity without needing higher-level credentials immediately.
The operational impact of this vulnerability is severe, encompassing potential denial of service, data exfiltration facilitation, and complete loss of trust in the application's security posture. An attacker can render the RansomLook installation unavailable by corrupting essential configuration parameters or disrupting external integrations that the system relies upon for its core functionality. Additionally, modifying authentication-related configurations could lock out legitimate administrators or weaken access controls, making subsequent attacks easier to execute. The exposure of configuration management through insufficiently authorized web functionality means that any credential theft via phishing, keylogging, or other common attack vectors can lead directly to systemic compromise rather than limited user-level disruption. This aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, highlighting the critical need for strict role-based access control in administrative interfaces.
To mitigate this vulnerability, the vendor has released a patch that completely removes the /admin/config route and its associated configuration-editing interface from the web UI. This approach eliminates the attack vector entirely by ensuring that application configuration cannot be modified through any web-accessible means, thereby enforcing a separation of duties where only direct server access or authorized administrative tools can alter critical settings. Organizations running affected versions should immediately apply this patch to restore security integrity. In addition to applying the vendor fix, administrators should audit existing user accounts to ensure no low-privileged users have unnecessary access to any remaining administrative endpoints and implement strict network segmentation for management interfaces. Regular vulnerability assessments and penetration testing focused on authorization flaws are recommended to identify similar weaknesses in other parts of the application stack before they can be exploited by adversaries seeking to disrupt operations or exfiltrate sensitive data.