Authentication Bypass in Webreaper Damselfly

Webreaper Damselfly versions 4.5.3 and earlier contain a critical authentication bypass vulnerability (CVE-2026-111626) affecting the API layer. The flaw stems from commented-out authorization attributes on all /api/* routes, which effectively disables access control checks for these endpoints. This allows remote, unauthenticated attackers to interact with sensitive API functions intended for administrative use.

By leveraging this oversight, attackers can manipulate the user management API to create new administrator accounts or modify existing credentials. The vulnerability allows for the full takeover of the application instance, as an attacker can register themselves as an administrator or reset the passwords of existing authorized users to gain persistence and full control over the application environment.

Impact

Successful exploitation results in full unauthorized administrative access to the affected Webreaper Damselfly instance. Attackers can create rogue accounts, modify existing user passwords, and access sensitive data stored within the application. This vulnerability poses a severe risk to any organization using Damselfly as it allows for trivial system takeover without prior authentication.

Recommendation

• Upgrade Webreaper Damselfly to a patched version beyond 4.5.3 immediately.
• Review application access logs for unexpected requests to the /api/users endpoint, specifically looking for PUT or POST requests originating from non-authorized source IPs.
• Audit the user management logs for the creation of new accounts or unauthorized password reset events that do not correlate with legitimate user activity.