CVE-2026-111644: Missing Authentication for Critical Function in l429609201 misaka_danmu_server
Description
Misaka Danmu Server versions up to 2.8.9 have a missing authentication vulnerability that permits unauthenticated attackers to access sensitive API routes. These routes under /api/ui lack proper user verification, allowing attackers to read audit logs, server logs, environment paths, and perform destructive actions such as deleting episode rows, clearing media-server mappings, and wiping audit history.
CVSS v4.0
Score 6.9medium
Affected software
l429609201
misaka_danmu_server
pkg:github/misaka_danmu_serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111644 describes a missing authentication vulnerability in misaka_danmu_server up to version 2.8.9. The affected API endpoints under /api/ui do not enforce the get_current_user dependency, enabling unauthenticated access to critical functions including audit, diagnostics, data-check, scan-index, and health routes. This flaw allows attackers to read sensitive logs and environment information and to perform destructive operations on server data.
Potential Impact
Unauthenticated attackers can access sensitive audit and server logs containing login IPs and environment paths, potentially exposing operational details. They can also delete episode data, clear media-server mappings, and erase audit history, leading to data loss and compromised system integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API routes by implementing authentication controls or network-level access restrictions to prevent unauthenticated access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:14.013Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad2640f2cdf04f65619956e
Added to database: 10/16/2026, 17:51:11 UTC
Last enriched: 10/16/2026, 18:49:00 UTC
Last updated: 10/16/2026, 19:03:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.