CVE-2026-92570 in reNgine
Riassunto
di MITRE • 16/09/2026
reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.