CVE-2026-102245: MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsensebackend/app/routes/circlebackwebhookroute.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
MODSetter SurfSense versions up to 2.0.3 are identified as affected. Prioritize instances where the circleback endpoint is reachable remotely, since the attack can be launched over the network.
Does exploitation require an account or user interaction?
No. The supplied vector indicates that exploitation requires no privileges and no user interaction, and the issue is described as missing authentication.
How urgent is remediation?
Remediation should be treated as high priority because public exploit material is available and the attack complexity is low. The reported impact includes confidentiality, integrity, and availability effects.
Is a vendor fix available?
The provided information does not identify a fixed version or vendor remediation. It states that the vendor was contacted but did not respond.