Webreaper CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Webreaper CVE published 2026-10-16

CVE-2026-111626

CVE-2026-111626 is a critical authentication bypass vulnerability in Webreaper Damselfly through version 4.5.3. The vulnerability allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can create administrator accounts or reset user passwords, gaining full control. Defenders and administrators of Webreaper Damselfly deployments [truncated]