CVE-2026-111644: Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

Q: Who can exploit the affected routes?

Any unauthenticated network-reachable attacker can exploit them. No credentials or user interaction are required.

Q: Which impacts go beyond information disclosure?

An attacker can delete episode rows, clear media-server mappings, and wipe audit history. They can also read audit logs containing login IP addresses, server logs, and environment paths.

Q: How can I determine whether an installation is affected?

Misaka Danmu Server versions through 2.8.9 are affected. An installation is exposed if unauthenticated requests can reach the listed /api/ui audit, diagnostics, data-check, scan-index, or health routes.

Published Oct 16, 2026

Updated

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.

Affected Software

1 affected component

Misaka Danmu Server<=2.8.9

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit the affected routes?

Any unauthenticated network-reachable attacker can exploit them. No credentials or user interaction are required.

Which impacts go beyond information disclosure?

An attacker can delete episode rows, clear media-server mappings, and wipe audit history. They can also read audit logs containing login IP addresses, server logs, and environment paths.

How can I determine whether an installation is affected?

Misaka Danmu Server versions through 2.8.9 are affected. An installation is exposed if unauthenticated requests can reach the listed /api/ui audit, diagnostics, data-check, scan-index, or health routes.

CVE-2026-111644: Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

Affected Software

Event History

Frequently Asked Questions

Who can exploit the affected routes?

Which impacts go beyond information disclosure?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit the affected routes?

Which impacts go beyond information disclosure?

How can I determine whether an installation is affected?