CVE-2026-78387
Received Received - Intake

Authorization Bypass in RansomLook Configuration Editor

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: CIRCL

Description
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to configuration-management functionality. An authenticated low-privileged user able to access the endpoint can submit crafted configuration values that are written directly to the application's config/generic.json file. The affected functionality permits modification of configuration sections including notification, LDAP, SMTP, and general application settings. Successful exploitation could therefore allow an attacker to alter security-sensitive application behavior, redirect integrations or notifications, modify authentication-related configuration, disrupt external services, or render the RansomLook installation unavailable. The configuration editor also operated on a configuration file containing sensitive values such as passwords, tokens, secrets, and API keys. Although the affected version contains logic intended to prevent recognized secret values from being returned to the browser, exposing configuration management through insufficiently authorized web functionality significantly increases the impact of a compromised or low-privileged account. The patch resolves the issue by completely removing the /admin/config route and associated configuration-editing interface, preventing application configuration from being modified through the web UI.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78387
EUVD
EUVD-2026-64890

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ransomlook ransomlook *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RansomLook has an authorization weakness in its web-based configuration editor accessible via the /admin/config endpoint. While it requires authentication, it does not verify if the user has administrator privileges before allowing access. This lets low-privileged authenticated users modify sensitive configuration files like config/generic.json, potentially changing security settings, authentication details, or disrupting services.

Detection Guidance

Check for unauthorized access to the /admin/config endpoint by reviewing web server logs for requests to this path. Inspect network traffic for unusual configuration file modifications or data exfiltration attempts targeting config/generic.json. Verify if low-privileged users have accessed administrative functions.

Impact Analysis

An attacker could exploit this to alter security-sensitive settings, steal credentials or API keys stored in configuration files, redirect notifications or integrations to malicious endpoints, disable the application, or disrupt external services the application relies on.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive configuration data like passwords, tokens, and API keys. Exposure of such data risks violating data protection requirements for confidentiality and integrity.

Mitigation Strategies

Apply the patch by removing the /admin/config route and configuration-editing interface as shown in the provided commit. Ensure no unauthorized configuration changes have been made. Review and restore config/generic.json from a trusted backup if tampered with.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart