CVE-2026-73405

Deferred Deferred - Pending Action

Authorization Bypass in Vulnerability-Lookup via SSE Subscription

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: CIRCL

Description

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint. The token_required decorator used by the Pub/Sub interface authenticated requests solely by matching the X-API-KEY header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account's is_active and is_confirmed state. Because the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments. The vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface. The patch corrects the issue by requiring accounts to be both active and confirmed before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73405

EUVD

EUVD-2026-57223

Affected Vendors & Products

Vendor	Product	Version / Range
vulnerability-lookup	vulnerability-lookup	to 2026-73405 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in Vulnerability-Lookup where inactive or unconfirmed accounts could subscribe to Server-Sent Events (SSE) streams using the /pubsub/subscribe/<topic> endpoint. The system authenticated requests only by matching an API key in the X-API-KEY header without verifying if the account was active or confirmed. Attackers could exploit this by creating an account, obtaining an API key, and immediately accessing SSE streams that should be restricted to active users.

Detection Guidance

To detect this vulnerability, check if inactive or unconfirmed accounts can access SSE streams via the /pubsub/subscribe/<topic> endpoint using their API keys. Monitor for unauthorized access attempts or unexpected 403 errors from the Pub/Sub interface.

Impact Analysis

If you are a user of Vulnerability-Lookup, this vulnerability could allow unauthorized access to sensitive streaming events, such as newly submitted or unmoderated data like comments. Attackers might intercept or view information that should be restricted to active, confirmed users, potentially exposing confidential or proprietary data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data streams. Unconfirmed or inactive accounts could access SSE streams containing sensitive information like comments or moderation data that should be restricted to active, confirmed users. This unauthorized access may violate data protection requirements for access controls and user authentication.

Mitigation Strategies

Apply the patch from the provided commit to enforce account status checks in the Pub/Sub interface. Ensure the token_required decorator validates both is_active and is_confirmed states before granting access to SSE streams.

Hi! I’m here to help you understand CVE-2026-73405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70