{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/firekylin--2.18.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:firekylin:firekylin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-125750"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Firekylin (\u003c= 2.18.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Firekylin"],"content_html":"\u003cp\u003eFirekylin versions 2.18.1 and earlier contain an improper authorization vulnerability in the admin API base guard. The vulnerability exists because the guard mechanism fails to restrict GET requests for administrative endpoints. An attacker authenticated with 'editor' privileges can perform unauthorized queries against the 'options.js' and 'user.js' endpoints to retrieve sensitive data, including TOTP secrets, push credentials, and cloud storage keys. Furthermore, attackers can exploit this access to retrieve user API keys ('app_key'/'app_secret'), enabling them to publish content as administrators via the 'admin/post_push' endpoint.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability includes the unauthorized disclosure of sensitive system configuration and administrative credentials, and the potential for account takeover or unauthorized content publication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Firekylin in the environment.\u003c/li\u003e\n\u003cli\u003eReview access logs for 'editor'-role users accessing 'options.js', 'user.js', or 'admin/post_push' endpoints.\u003c/li\u003e\n\u003cli\u003eUpgrade Firekylin to a version beyond 2.18.1 immediately upon vendor patch release.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T18:27:48Z","date_published":"2026-11-10T18:27:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-firekylin-auth-bypass/","summary":"Firekylin versions 2.18.1 and earlier contain an improper authorization flaw in the admin API that allows editor-role users to access sensitive administrative secrets and perform unauthorized actions.","title":"Firekylin: Improper authorization vulnerability (CVE-2026-125750)","url":"https://feed.craftedsignal.io/briefs/2026-11-firekylin-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Firekylin (\u003c= 2.18.1)","version":"https://jsonfeed.org/version/1.1"}