{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/webreaper/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webreaper:damselfly:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111626"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Damselfly (\u003c= 4.5.3)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","api-vulnerability","vulnerability-management"],"_cs_type":"advisory","_cs_vendors":["Webreaper"],"content_html":"\u003cp\u003eWebreaper Damselfly versions 4.5.3 and earlier contain a critical authentication bypass vulnerability (CVE-2026-111626) affecting the API layer. The flaw stems from commented-out authorization attributes on all /api/* routes, which effectively disables access control checks for these endpoints. This allows remote, unauthenticated attackers to interact with sensitive API functions intended for administrative use.\u003c/p\u003e\n\u003cp\u003eBy leveraging this oversight, attackers can manipulate the user management API to create new administrator accounts or modify existing credentials. The vulnerability allows for the full takeover of the application instance, as an attacker can register themselves as an administrator or reset the passwords of existing authorized users to gain persistence and full control over the application environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full unauthorized administrative access to the affected Webreaper Damselfly instance. Attackers can create rogue accounts, modify existing user passwords, and access sensitive data stored within the application. This vulnerability poses a severe risk to any organization using Damselfly as it allows for trivial system takeover without prior authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Webreaper Damselfly to a patched version beyond 4.5.3 immediately.\u003c/li\u003e\n\u003cli\u003eReview application access logs for unexpected requests to the /api/users endpoint, specifically looking for PUT or POST requests originating from non-authorized source IPs.\u003c/li\u003e\n\u003cli\u003eAudit the user management logs for the creation of new accounts or unauthorized password reset events that do not correlate with legitimate user activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:44:26Z","date_published":"2026-10-16T18:44:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-damselfly-auth-bypass/","summary":"Webreaper Damselfly versions 4.5.3 and earlier contain an authentication bypass vulnerability in API routes that allows unauthenticated attackers to escalate privileges and perform administrative actions.","title":"Authentication Bypass in Webreaper Damselfly","url":"https://feed.craftedsignal.io/briefs/2026-10-damselfly-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Webreaper","version":"https://jsonfeed.org/version/1.1"}