CVE-2026-111643 l429609201 CVE debrief

Who should care

Administrators and security teams responsible for Misaka Danmu Server instances should assess exposure and verify configurations to prevent exploitation. They should review and verify the configuration of Misaka Danmu Server instances, implement additional security measures, and monitor server logs for suspicious activity. Security teams should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Why it matters

CVE-2026-111643 is a critical authentication bypass vulnerability in Misaka Danmu Server through 2.8.9, allowing unauthenticated attackers to write arbitrary configuration keys. Administrators and security teams should assess exposure, verify configurations, and implement additional security measures to prevent exploitation.

• Unauthenticated attackers can write arbitrary configuration keys, potentially allowing access to protected endpoints.
• Attackers can set the ipWhitelist key to their own /32 address or alter trustedProxies and webhookApiKey to gain administrative access.
• Verification of server configurations and monitoring for suspicious activity are necessary to prevent exploitation.

Technical summary

The Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. This vulnerability has a CVSS score of 9.3 and is considered CRITICAL. The vulnerability can be exploited to gain administrative access by setting the ipWhitelist key to their own /32 address or altering trustedProxies and webhookApiKey. Verification of server configurations and monitoring for suspicious activity are necessary to prevent exploitation.

Defensive priority

High

Recommended defensive actions

• Review and verify the configuration of Misaka Danmu Server instances to ensure that they are not vulnerable to authentication bypass.
• Implement additional security measures to restrict access to the /api/ui/config-history/rollback endpoint.
• Monitor server logs for suspicious activity related to the /api/ui/config-history/rollback endpoint.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the authentication bypass vulnerability in Misaka Danmu Server through 2.8.9. The vulnerability allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. The CVSS score of 9.3 indicates a critical vulnerability. Evidence from the CVE Program and NVD suggests that the vulnerability is exploitable and can be used to gain administrative access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.