Threats tagged 'ghsa-c5c3-5f6v-5chh'

Misaka Danmu Server versions up to 2.8.9 have a missing authentication vulnerability in several critical API routes under /api/ui. This flaw allows unauthenticated attackers to access sensitive audit, diagnostics, and data management functions, including reading audit logs with login IPs, server logs, environment paths, deleting episode rows, clearing media-server mappings, and wiping audit history. The vulnerability has a medium severity with a CVSS score of 6.9.