CVE-2026-92570 describes an authorization bypass vulnerability in yogeshojha's rengine product through version 2.2.0. The vulnerability exists in the GetFileContents API endpoint, which fails to enforce role-based access control. As a result, users with Auditor roles can retrieve bundled recon tool configuration files, exposing API keys for external services such as SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter. This exposure can lead to unauthorized access to these third-party services via compromised API credentials.

The vulnerability allows low-privilege authenticated users to read sensitive configuration files containing third-party API keys. This could lead to unauthorized use of these external services, potentially resulting in data leakage or abuse of the associated accounts. However, there is no indication of remote unauthenticated exploitation or privilege escalation beyond the Auditor role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Auditor role assignments and monitor access to the GetFileContents API endpoint to limit exposure.