CVE-2026-113703: SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication() in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(xfor=1) configuration in apiservice/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via loadbypassusercontext(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuggestArrto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
SuggestArr versions before 3.0.0 are exposed when configured to use local_bypass authentication mode. The bypass relies on the application accepting a spoofed X-Forwarded-For value through its ProxyFix(x_for=1) configuration.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely without credentials by sending a request with X-Forwarded-For set to a trusted CIDR address, such as 127.0.0.1. User interaction is required according to the supplied severity vector.
What access can successful exploitation provide?
Successful exploitation grants an unauthenticated administrative session through _load_bypass_user_context(). This can provide full administrative access to endpoints including /api/users and /api/jobs.
What should be done if an immediate upgrade is not possible?
The provided information identifies local_bypass mode as the affected authentication mode. Avoid using local_bypass until the instance can be upgraded to version 3.0.0 or later.