CVE-2026-111643: Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs only network access to the POST /api/ui/config-history/rollback endpoint. No authentication or user interaction is required.
Which deployments are affected?
Misaka Danmu Server versions through 2.8.9 are affected. The vulnerable rollback endpoint is described as unprotected, so deployments exposing the UI API endpoint are at risk.
What configuration changes should responders investigate?
Check for unexpected changes to ipWhitelist, trustedProxies, and webhookApiKey. An attacker can use these keys to add their own address to the allowlist, alter proxy trust, or change the webhook API key and then obtain administrator-level access to protected endpoints.
What can be done if an update is not immediately available?
Limit network access to the UI API, particularly POST /api/ui/config-history/rollback, so unauthenticated attackers cannot reach it. Review the listed security-related configuration keys for unauthorized modifications.