bunkerity bunkerweb up to 1.6.11 BiscuitMiddleware cache.py authorization

Summaryinfo

A vulnerability has been found in bunkerity bunkerweb up to 1.6.11 and classified as critical. The affected element is an unknown function of the file src/ui/app/routes/cache.py of the component BiscuitMiddleware. This manipulation causes authorization. This vulnerability is tracked as CVE-2026-61718. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in bunkerity bunkerweb up to 1.6.11. It has been declared as critical. Affected by this vulnerability is an unknown part of the file src/ui/app/routes/cache.py of the component BiscuitMiddleware. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @login_required, including POST /cache/delete, allowed low-privilege read-only reader accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-61718 since 07/10/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.6.12 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• bunkerity

Name

• bunkerweb

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11

Website

• Product: https://github.com/bunkerity/bunkerweb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion