Threat database

Misaka Danmu Server versions up to 2.8.9 have a missing authentication vulnerability in several critical API routes under /api/ui. This flaw allows unauthenticated attackers to access sensitive audit, diagnostics, and data management functions, including reading audit logs with login IPs, server logs, environment paths, deleting episode rows, clearing media-server mappings, and wiping audit history. The vulnerability has a medium severity with a CVSS score of 6.9.

Misaka Danmu Server versions up to 2.8.9 have an authentication bypass vulnerability in the POST /api/ui/config-history/rollback endpoint. This flaw allows unauthenticated attackers to write arbitrary configuration keys, including ipWhitelist, trustedProxies, and webhookApiKey, enabling them to gain administrator-level access to all protected endpoints.