CVE-2026-110617 rachelos CVE debrief

Who should care

Defenders responsible for we-mp-rss deployments, especially those using version 1.5.3 or earlier, should assess exposure and consider remediation. Defenders should verify the presence of this vulnerability in their environments, especially if using we-mp-rss version 1.5.3 or earlier, and consider restricting access to the affected endpoint. Operators, platform administrators, vulnerability management teams, and security teams should review the affected we-

Why it matters

CVE-2026-110617 is a missing authorization vulnerability in we-mp-rss that allows unauthenticated attackers to download and potentially delete export archives. Defenders should verify the presence of this vulnerability in their environments and consider restricting access to the affected endpoint.

• Potential unauthorized access to export archives.
• Possible deletion of export archives by attackers.

Technical summary

The vulnerability exists in the /api/v1/wx/tools/export/download endpoint of we-mp-rss through version 1.5.3. The endpoint's authentication dependency is commented out, allowing unauthenticated attackers to download export archives by supplying an mp_id and guessable timestamp-based export filename. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs. They can also set delete_after_download=true to delete the archives after download. Defenders should prioritize verifying the presence of this vulnerability in their environments, especially if using we-mp-rss version 1.5.3 or earlier, and consider restricting access to the affected endpoint.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their environments, especially if using we-mp-rss version 1.5.3 or earlier, and consider restricting access to the affected endpoint.

Recommended defensive actions

• Verify the presence of we-mp-rss version 1.5.3 or earlier in your environment.
• Restrict access to the /api/v1/wx/tools/export/download endpoint.
• Consider updating to a version of we-mp-rss that addresses this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence in we-mp-rss through version 1.5.3, the affected endpoint, and potential attacker actions. Defenders should verify the presence of this vulnerability in their environments, especially if using we-mp-rss version 1.5.3 or earlier, and consider restricting access to the affected endpoint. The vulnerability exists in the /api/v1/wx/tools/export/download endpoint of we-mp-rss through version 1.5.3. The endpoint's authentication dependency is 7

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.