CVE-2026-78386
Received Received - Intake

Information Disclosure in RansomLook Scraping API

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: CIRCL

Description
RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These records could contain internal fields such as header, which may include authentication headers, session cookies, or other credentials used to access monitored websites; init_script, which may contain logic used to bypass CAPTCHA, anti-bot protections, or paywalls; and browser, which discloses details about the scraping environment. An unauthenticated remote attacker could query the affected API endpoints and obtain these values. Leaked authentication material could potentially be replayed against the monitored service, while disclosure of scraping and bypass logic could allow site operators or other attackers to identify and defeat RansomLook's collection mechanisms. The patch introduces an explicit allowlist of fields permitted in public location records and strips all operator-side fields before returning data to unauthenticated users. The accompanying change from <string:postname> to <path:postname> appears to be a functional correction allowing legitimate post titles containing / and does not, based on this patch alone, represent the security issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78386
EUVD
EUVD-2026-64888

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ransomlook ransomlook *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RansomLook had an issue where sensitive scraping configuration details were exposed through unauthenticated API responses. This included authentication headers, session cookies, CAPTCHA bypass logic, and browser details used by the service to monitor ransomware groups and markets.

Detection Guidance

To detect this vulnerability, check for unauthenticated API responses exposing sensitive fields like headers, init_script, or browser details. Monitor network traffic for requests to affected endpoints returning location records with internal scraping configurations.

Impact Analysis

An attacker could exploit this to steal authentication credentials or scraping logic. This could allow them to access monitored services, bypass security measures, or identify how RansomLook collects data, potentially disrupting its operations.

Compliance Impact

The vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. Unauthenticated access to scraping configurations may reveal authentication headers, session cookies, or credentials, which could constitute a data breach under GDPR (Article 4) and HIPAA (45 CFR § 164.402). The disclosure of such data risks violating confidentiality requirements and could result in regulatory penalties.

Mitigation Strategies

Apply the patch that introduces an allowlist for public location records and strips operator-side fields before returning data to unauthenticated users. Ensure API endpoints no longer expose sensitive fields like headers or init_script in responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78386. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart