CVE-2026-111644 — Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and …
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7