CVE-2026-59509

Summary

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

Affected Software

Weaknesses

• CWE-20: CWE-20 Improper Input Validation

References

• https://github.com/cve-search/cve-search/pull/1218
• https://github.com/cve-search/cve-search/issues/1217

• ←Previous
• Next→