CVE-2026-78370
Received Received - Intake

Information Disclosure in RansomLook via Unauthenticated Export

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: CIRCL

Description
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be exported without requiring authentication. While limited filtering is performed for some entity databases, other exportable databases are returned directly without consistently applying the application's private-entity access restrictions. As a result, information associated with groups, markets, posts, or other records marked as private may be included in an export accessible to an unauthenticated requester. An attacker able to reach the RansomLook web application can request the affected export endpoint and retrieve data that should only be available to authorized users. Depending on the contents of the instance, this may disclose private ransomware intelligence, victim information, internal tracking data, or other information deliberately excluded from public views. The patch removes the legacy unauthenticated export route and introduces centralized authorization handling that distinguishes ordinary authenticated API access from authorization to view private entries. API keys must now be explicitly granted private-data access, while existing keys do not automatically receive this privilege. The same private-data filtering is also applied consistently across API responses and database exports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78370
EUVD
EUVD-2026-64843

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ransomlook ransomlook *
ransomlook ransomlook From 2026-01-01 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RansomLook has an authorization flaw in its legacy database export feature. The /export/<database> endpoint allows unauthenticated users to retrieve private information from certain databases without proper access restrictions. This means sensitive data like private ransomware intelligence or victim details could be exposed to unauthorized parties.

Detection Guidance

Check if unauthenticated requests to the /export/<database> endpoint return sensitive data. Use curl to test the endpoint: curl -v http://<target>/export/<database>. If the response includes private information without authentication, the vulnerability is present.

Impact Analysis

If you use RansomLook, an attacker could access private data through the vulnerable export endpoint. This may include confidential information about ransomware operations, victims, or internal tracking data that should remain restricted. The impact depends on what sensitive data your instance contains.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR's data protection principles or HIPAA's privacy rules. Organizations using RansomLook may face compliance violations, legal penalties, and reputational damage if private data is exposed.

Mitigation Strategies

Apply the patch from the RansomLook repository to remove the unauthenticated export route and implement centralized authorization handling. Ensure API keys are explicitly granted private-data access and verify that private-data filtering is applied consistently across all exports and API responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78370. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart