CVE-2026-111626: Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Webreaper Damselfly versions through 4.5.3 are affected if their REST API is reachable by an attacker. The exposed routes are under /api/*, and no authentication is required to access them.
What does an attacker need to exploit this issue?
An attacker only needs network access to the application's REST API. Exploitation requires no valid account, privileges, or user interaction.
What is the practical impact of successful exploitation?
An attacker can send a PUT request to /api/users assigning Admin roles to create an administrator account. They can also send a POST request to /api/users to reset any user's password, enabling full control of the application.
How can I check whether my instance has been compromised?
Review user-management activity for unexpected administrator accounts, unexpected Admin role assignments, and password resets for existing users. Also review requests to /api/users, particularly unauthenticated PUT and POST requests.