CVE-2026-102245
Received Received - Intake

Authentication Bypass in MODSetter SurfSense

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulDB

Description
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102245
EUVD
EUVD-2026-88619

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
modsetter surfsense to 2.0.3 (inc)
modsetter surfsense 0.0.36

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated cross-tenant knowledge-base write issue in SurfSense version 0.0.36. It exists in the FastAPI backend's Circleback webhook handler, which exposes an endpoint without authentication or signature verification. Attackers can send crafted requests to inject arbitrary meeting documents into any workspace by guessing workspace IDs. The injected documents become searchable via chat or RAG systems.

Detection Guidance

Check for unauthorized POST requests to /api/v1/webhooks/circleback/{workspace_id} without authentication. Inspect logs for repeated access attempts to this endpoint. Verify if GET /api/v1/webhooks/circleback/{workspace_id}/info returns sensitive data without authentication.

Impact Analysis

An attacker could poison your workspace knowledge base by injecting fake documents, overwrite existing documents, or consume system resources. This could lead to misinformation, data corruption, or service disruption without requiring any account or invite.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data injection or modification in systems handling sensitive information. It may lead to breaches of data integrity and confidentiality, which are critical under GDPR and HIPAA.

Mitigation Strategies

Disable the vulnerable endpoints until HMAC verification is implemented. Restrict access to the FastAPI backend. Implement per-workspace HMAC or shared-secret verification for Circleback POST requests. Return 404 for workspaces without Circleback connectors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart