CVE-2026-110617: we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable timestamp-based export filename to retrieve archives under data/docs, and set deleteafterdownload=true to delete them.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the affected endpoint can attempt exploitation. No account or user interaction is required, but the attacker must provide an mp_id and correctly guess a timestamp-based export filename.
What data and systems are at risk?
Export archives stored under data/docs may be downloaded by an attacker. An attacker can also request deletion of a retrieved archive by setting delete_after_download=true, creating a potential availability impact for those export files.
Are default deployments affected?
The affected endpoint lacks its authentication dependency because it is commented out. Deployments running we-mp-rss through 1.5.3 with this endpoint reachable are affected regardless of whether an attacker has credentials.
What can be done if patching is not immediately possible?
Restrict network access to /api/v1/wx/tools/export/download so unauthenticated users cannot reach it. Limit exposure of the application and protect export archives under data/docs until the affected code can be remediated.