CVE-2026-111626Published
Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111626 · Microsoft / collected KEV context
cve-program · CVE-2026-111626
- https://hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242
- https://github.com/Webreaper/Damselfly/issues/409
- https://www.vulncheck.com/advisories/webreaper-damselfly-through-4.5.3-missing-authentication-on-rest-api-controllers
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.