CVE-2026-113703
Received Received - Intake

Authentication Bypass in SuggestArr via X-Forwarded-For Spoofing

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113703
EUVD
EUVD-2026-105106

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
giuseppe99barchetta SuggestArr 1.0.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in SuggestArr versions before 3.0.0. It occurs in the local_bypass authentication mode where the application incorrectly trusts the X-Forwarded-For header to determine the client's IP address. Attackers can spoof a trusted IP address like 127.0.0.1 in this header, bypassing authentication and gaining full administrative access to endpoints such as /api/users and /api/jobs without providing credentials.

Detection Guidance

Check SuggestArr versions before 3.0.0 by inspecting the application version or logs. Monitor HTTP requests for X-Forwarded-For headers containing trusted CIDR addresses like 127.0.0.1. Use network traffic analysis tools to detect unauthorized access to admin endpoints such as /api/users or /api/jobs without authentication.

Impact Analysis

An attacker exploiting this vulnerability could gain full administrative access to your SuggestArr instance. This allows them to read sensitive data like user lists and job configurations, modify settings, or perform unauthorized actions without any prior privileges or user interaction. The impact includes potential data breaches, unauthorized system control, and loss of confidentiality and integrity.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive user data. GDPR requires protecting personal data, and HIPAA mandates securing health-related information. A breach via this flaw may result in unauthorized data exposure, violating these regulations and potentially leading to legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade SuggestArr to version 3.0.0 or later immediately. Disable the local_bypass authentication mode if not required. Configure reverse proxies to strip or validate X-Forwarded-For headers. Restrict access to admin endpoints to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart