CVE-2026-59509: cve-search, невалидиран вход

Описание

Оригинално описание

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

Засегнати продукти

• cve-search cve-search: v4.0 до v6.0.0

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-59509
• https://nvd.nist.gov/vuln/detail/CVE-2026-59509
• https://github.com/cve-search/cve-search/pull/1218
• https://github.com/cve-search/cve-search/issues/1217