A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. (CVE-2026-90507)
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AI Analysis
Technical Summary
CVE-2026-90507 is an access control vulnerability in the get_surge_subscription function within services/subscription.py of the Subscription Handler component in vvbbnn00 WARP-Clash-API. Manipulating the argument key leads to improper access controls. The vulnerability is remotely exploitable, and public exploit code is available. The product is delivered via rolling releases without fixed version numbers. The vendor did not respond to early disclosure, and the affected product is no longer maintained.
Potential Impact
Successful exploitation can lead to unauthorized access impacting confidentiality, integrity, and availability to a limited extent (CVSS 6.3). The vulnerability allows remote attackers to bypass access controls by manipulating input parameters. Since the product is no longer supported, no official fixes or patches are available.
Mitigation Recommendations
No official patch or remediation is available as the product is no longer supported by the maintainer and the vendor did not respond to disclosure. Users should consider discontinuing use of the affected product or implementing compensating controls to restrict access to the vulnerable functionality.
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. (CVE-2026-90507)
Description
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1
Score 6.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90507 is an access control vulnerability in the get_surge_subscription function within services/subscription.py of the Subscription Handler component in vvbbnn00 WARP-Clash-API. Manipulating the argument key leads to improper access controls. The vulnerability is remotely exploitable, and public exploit code is available. The product is delivered via rolling releases without fixed version numbers. The vendor did not respond to early disclosure, and the affected product is no longer maintained.
Potential Impact
Successful exploitation can lead to unauthorized access impacting confidentiality, integrity, and availability to a limited extent (CVSS 6.3). The vulnerability allows remote attackers to bypass access controls by manipulating input parameters. Since the product is no longer supported, no official fixes or patches are available.
Mitigation Recommendations
No official patch or remediation is available as the product is no longer supported by the maintainer and the vendor did not respond to disclosure. Users should consider discontinuing use of the affected product or implementing compensating controls to restrict access to the vulnerable functionality.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-29fp-xrf7-2x4f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90507"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa741a755bf5e2cf5489bf9
Added to database: 09/14/2026, 00:36:55 UTC
Last enriched: 09/14/2026, 00:43:25 UTC
Last updated: 09/14/2026, 03:01:22 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.