RansomLook up to 2.0.0 Form Fields /admin/apikeys information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in RansomLook up to 2.0.0. This affects an unknown function of the file /admin/apikeys of the component Form Fields. Performing a manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-78555. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in RansomLook up to 2.0.0. It has been classified as problematic. This affects some unknown functionality of the file /admin/apikeys of the component Form Fields. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions. As a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions. The patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-78555 since 08/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Applying the patch b358dfa4f40c677a47c602ebbb4473aeae349f5c is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• RansomLook

Version

• 2.0

Website

• Product: https://github.com/RansomLook/RansomLook/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion