Authentication Bypass in Misaka Danmu Server

Misaka Danmu Server versions 2.8.9 and earlier are affected by a critical authentication bypass vulnerability (CVE-2026-111643) originating in the /api/ui/config-history/rollback endpoint. This endpoint lacks proper authentication checks, allowing unauthenticated remote attackers to perform unauthorized configuration modifications. By sending a crafted POST request to this endpoint, an attacker can overwrite sensitive configuration keys such as 'ipWhitelist', 'trustedProxies', and 'webhookApiKey'. Successfully altering these keys permits the attacker to bypass access controls, effectively granting them administrative control over all protected API endpoints. Given the CVSS 3.1 base score of 9.8, this vulnerability poses a severe risk to service integrity and confidentiality.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative access to the Danmu Server installation. This impact enables attackers to exfiltrate sensitive data, manipulate system operations, or gain persistent access by modifying webhook configurations or trusted proxy settings, potentially leading to total system compromise in affected environments.

Recommendation

• Immediately upgrade Misaka Danmu Server to a version beyond 2.8.9 to remediate the vulnerability.
• Audit logs for unauthorized POST requests directed at the /api/ui/config-history/rollback endpoint.
• Monitor changes to the 'ipWhitelist', 'trustedProxies', and 'webhookApiKey' configuration values within the application logs for any suspicious modifications.