Misaka Danmu Server Auth Bypass (CVE-2026-111643) Lets Unauthenticated Attackers Take Admin Control

"An unprotected config-rollback endpoint in Misaka Danmu Server through version 2.8.9 lets unauthenticated attackers rewrite configuration keys and reach every protected endpoint as the administrator."

An unprotected config-rollback endpoint in Misaka Danmu Server through version 2.8.9 lets unauthenticated attackers rewrite configuration keys and reach every protected endpoint as the administrator.

What Is It

CVE-2026-111643 is an authentication bypass in Misaka Danmu Server, categorized as CWE-306 (Missing Authentication for Critical Function). The POST /api/ui/config-history/rollback endpoint has no authentication check, so an unauthenticated attacker can use it to write arbitrary configuration keys.

According to the NVD description, an attacker can abuse this in several ways:

Set the ipWhitelist key to their own /32 address
Change the trustedProxies setting
Change the webhookApiKey value

Any of these changes gives the attacker administrator access to every protected endpoint on the server. VulnCheck disclosed the issue, and NVD published it on October 16, 2026.

Why It Matters

VulnCheck scores the flaw 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. The attack works over the network, has low complexity, and needs no privileges or user interaction. It has a high impact on confidentiality, integrity, and availability.

The flaw doesn't just expose data. It lets an attacker change the server's own access controls, which turns one unauthenticated request into full administrative control of the instance.

Exploitation status: CVE-2026-111643 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so active exploitation is not confirmed. A public write-up describing the missing authentication is available (see Sources).

What's Vulnerable

Vendor: l429609201
Product: misaka_danmu_server
Affected versions: all versions through and including 2.8.9
Repository: https://github.com/l429609201/misaka_danmu_server

The NVD record links to the vulnerable code in v2.8.9: the rollback handler in src/api/ui/config_history.py and the access-control logic in src/security.py. NVD lists the record's status as "Deferred" and gives no CPE entries.

Patch Status

The supplied data does not name a fixed version. CISA has not issued a required action because the CVE is not in KEV. Operators running version 2.8.9 or earlier should watch the project repository and the VulnCheck advisory for a fixed release. Until a fix ships, keep the server's UI/API interface off untrusted networks. Admins should also check whether ipWhitelist, trustedProxies, and webhookApiKey have been changed unexpectedly.