CVE-2026-111643 — Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected…
Published: 2026-10-16 · CVSS: 9.3 · CVSS 4.0
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7