CVE-2026-110617: Missing Authorization in rachelos we-mp-rss
Description
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.
CVSS v4.0
Score 6.3medium
Affected software
rachelos
we-mp-rss
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in rachelos we-mp-rss (<=1.5.3) involves a missing authorization check in the /api/v1/wx/tools/export/download API endpoint. Because the authentication dependency is commented out, unauthenticated attackers can download export archives located under data/docs by supplying an mp_id and guessing the timestamp-based export filename. Additionally, attackers can delete these archives by setting the delete_after_download parameter to true. This flaw allows unauthorized access and potential deletion of sensitive export data.
Potential Impact
Unauthenticated attackers can access and download export archives without proper authorization, potentially exposing sensitive data. They can also delete these archives, leading to data loss. The CVSS 4.0 score of 6.3 indicates a medium severity impact with network attack vector, low complexity, and no user interaction required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint and monitor for unauthorized access attempts. Review and restore proper authorization checks in the /api/v1/wx/tools/export/download endpoint to prevent unauthenticated downloads and deletions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T13:07:25.853Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acf92ed2cdf04f6568a3838
Added to database: 10/14/2026, 14:34:21 UTC
Last enriched: 10/14/2026, 15:04:16 UTC
Last updated: 10/14/2026, 19:00:29 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.