Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability on /api/ui routes, allowing unauthenticated access to sensitive data and actions. This vulnerability affects defenders responsible for Misaka Danmu Server instances, especially those with publicly accessible /api/ui routes. They should assess potential exposure and prioritize verification and remediation to prevent unauthori [truncated]
CVE-2026-111643 is a critical authentication bypass vulnerability in Misaka Danmu Server through 2.8.9. This vulnerability allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. The vulnerability has a CVSS score of 9.3 and is considered CRITICAL. Administrators and security teams should assess exposure and verify configura [truncated]
