CVE-2026-111699: Missing Authentication for Critical Function in niefy wx-api

CVE-2026-111699 describes an authentication bypass in niefy wx-api through version 0.8.2. The vulnerability allows unauthenticated attackers to impersonate WeChat fans by providing a raw openid cookie to fan-facing controllers. With knowledge of a victim's openid, attackers can call the /wxUser/getUserInfo and /wxUserTags endpoints to read sensitive user information (nickname, phone, unionid, tags) and to add or remove fan tags. The CVSS 4.0 base score is 6.3, indicating a medium severity with network attack vector, high attack complexity, and no privileges or user interaction required.

An attacker who knows a victim's openid can bypass authentication controls to impersonate that user and access personal data including nickname, phone number, unionid, and tags. Additionally, the attacker can modify fan tags, potentially affecting user categorization or access control. This exposure of personal data and unauthorized modification capability poses privacy and integrity risks.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints and monitor for suspicious usage of openid cookies if possible.