Firekylin (<= 2.18.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/firekylin--2.18.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 18:27:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFirekylin: Improper authorization vulnerability (CVE-2026-125750)https://feed.craftedsignal.io/briefs/2026-11-firekylin-auth-bypass/Tue, 10 Nov 2026 18:27:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-firekylin-auth-bypass/Firekylin versions 2.18.1 and earlier contain an improper authorization flaw in the admin API that allows editor-role users to access sensitive administrative secrets and perform unauthorized actions.Firekylin versions 2.18.1 and earlier contain an improper authorization vulnerability in the admin API base guard. The vulnerability exists because the guard mechanism fails to restrict GET requests for administrative endpoints. An attacker authenticated with 'editor' privileges can perform unauthorized queries against the 'options.js' and 'user.js' endpoints to retrieve sensitive data, including TOTP secrets, push credentials, and cloud storage keys. Furthermore, attackers can exploit this access to retrieve user API keys ('app_key'/'app_secret'), enabling them to publish content as administrators via the 'admin/post_push' endpoint.

Impact

The impact of this vulnerability includes the unauthorized disclosure of sensitive system configuration and administrative credentials, and the potential for account takeover or unauthorized content publication.

Recommendation

  • Identify all instances of Firekylin in the environment.
  • Review access logs for 'editor'-role users accessing 'options.js', 'user.js', or 'admin/post_push' endpoints.
  • Upgrade Firekylin to a version beyond 2.18.1 immediately upon vendor patch release.
]]>highadvisory