PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55835 Lookyloo CVE debrief

CVE-2026-55835 is a vulnerability in Lookyloo, a web interface for capturing and displaying website page connections. An unauthenticated user can trigger Lookyloo's 'report a capture' email feature, potentially causing a Denial of Service (DoS) on a MISP instance if configured. The issue arises from a parameter mismatch that overwrites the 'as_admin' parameter, allowing an attacker to trigger a search query on a MISP instance and add a list of matching URLs in the email sent to the analyst. This could lead to a DoS on the MISP instance. The vulnerability is patched in version 1.39.4. Defenders should assess exposure and verify patch status, especially for instances with MISP The /

Vendor
Lookyloo
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-23
Advisory published
2026-10-23
Advisory updated
2026-10-23

Who should care

Defenders responsible for Lookyloo instances, especially those with MISP integration, should assess exposure and verify patch status. They should also review compensating controls for exposed systems and monitor for unusual 'report a capture' activity. Additionally, defenders should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-55835 is a medium-severity vulnerability in Lookyloo that can potentially cause a DoS on a MISP instance. Defenders should verify patch status and assess MISP integration.

  • Potential DoS on MISP instance
  • Need to verify Lookyloo version and MISP integration
  • Possible increased monitoring for 'report a capture' activity

Technical summary

CVE-2026-55835 is a vulnerability in Lookyloo's 'report a capture' feature. An unauthenticated user can trigger the feature, potentially causing a DoS on a MISP instance if configured. The issue is due to a parameter mismatch that overwrites the 'as_admin' parameter, allowing an attacker to trigger a search query on a MISP instance and add a list of matching URLs in the email sent to the analyst. The vulnerability is patched in version 1.39.4. Defenders should prioritize verifying Lookyloo instances for version 1.39.4 or later, especially if MISP integration is used.

Defensive priority

Defenders should prioritize verifying Lookyloo instances for version 1.39.4 or later, especially if MISP integration is used.

Recommended defensive actions

  • Verify Lookyloo instances for version 1.39.4 or later
  • Assess MISP integration for potential DoS risk
  • Monitor for unusual 'report a capture' activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability and its patch. Lookyloo version 1.39.4 or later is recommended to prevent potential DoS on MISP instances. The vulnerability is caused by a parameter mismatch in the 'report a capture' feature, which can be triggered by an unauthenticated user. Defenders should verify patch status and assess MISP integration for potential risks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55835 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55835

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55835 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55835

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Lookyloo: Potential sub-system DoS due to parameter missmatch in notification

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55835.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-66gj-hmcp-5cfj

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Lookyloo/lookyloo/pull/1330

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Lookyloo/lookyloo/releases/tag/v1.39.4

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.