CVE-2026-55183: CWE-306: Missing Authentication for Critical Function in Zarestia-Dev rclone-manager

RClone Manager is a GUI application for managing Rclone remotes. Versions before 0.2.7 launch the local rclone rcd service on 127.0.0.1:51900 with the flags --rc-no-auth, --rc-allow-origin *, and --rc-serve, resulting in missing authentication for critical functions (CWE-306). This allows a malicious web page opened by the user to send cross-origin requests to the unauthenticated local API with the user's OS privileges. Exploitation can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate files accessible locally or through configured remotes. The advisory notes a possible command execution impact but it remains unconfirmed. The issue is resolved in version 0.2.7.

An attacker can leverage this vulnerability to perform unauthorized actions on the local rclone rcd service, including disclosure of storage credentials and unauthorized file operations such as access, upload, modification, or exfiltration. This compromises confidentiality, integrity, and availability of user data and remote storage managed by RClone Manager. The CVSS score of 9.6 reflects critical impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade RClone Manager to version 0.2.7 or later, where the issue is fixed by enforcing authentication on the local rclone rcd service. No other mitigation is required as the fix addresses the root cause.