PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111644 l429609201 CVE debrief

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability on /api/ui routes, allowing unauthenticated access to sensitive data and actions. This vulnerability affects defenders responsible for Misaka Danmu Server instances, especially those with publicly accessible /api/ui routes. They should assess potential exposure and prioritize verification and remediation to prevent unauthorized access to audit logs with login IPs, server logs, and environment paths, as well as potential deletion of episode rows, clearing of media-server mappings, and wiping of audit history.

Vendor
l429609201
Product
misaka_danmu_server
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-21
Advisory published
2026-10-16
Advisory updated
2026-10-21

Who should care

Defenders responsible for Misaka Danmu Server instances, especially those with publicly accessible /api/ui routes, should assess potential exposure and prioritize verification and remediation.

Why it matters

Defenders should prioritize verifying exposure of Misaka Danmu Server instances, especially those with publicly accessible /api/ui routes, and assess potential data access or manipulation.

  • Unauthenticated access to audit logs with login IPs, server logs, and environment paths
  • Potential deletion of episode rows
  • Clearing of media-server mappings
  • Wiping of audit history require verification

Technical summary

The Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability on /api/ui routes, allowing unauthenticated attackers to access sensitive data and actions. This vulnerability enables attackers to read audit logs with login IPs, server logs, and environment paths, delete episode rows, clear media-server mappings, and wipe audit history. Defenders should prioritize verifying exposure of Misaka Danmu Server instances, especially those with publicly accessible /api/ui routes, and assess potential data access or manipulation.

Defensive priority

Defenders should prioritize verifying exposure of Misaka Danmu Server instances, especially those with publicly accessible /api/ui routes, and assess potential data access or manipulation.

Recommended defensive actions

  • Verify exposure of Misaka Danmu Server instances, especially those with publicly accessible /api/ui routes
  • Assess potential data access or manipulation
  • Implement authentication for /api/ui routes
  • Monitor for suspicious activity on /api/ui routes
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in Misaka Danmu Server through 2.8.9. The vulnerability allows unauthenticated attackers to access sensitive routes and perform actions such as reading audit logs, deleting episode rows, and clearing media-server mappings.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111644 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111644

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111644 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111644

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111644.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/audit.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/data_check.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/diagnostics.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/misaka-danmu-server-through-2.8.9-missing-authentication-on-api-ui-routes

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.