CVE-2026-119598: Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id
Published Oct 30, 2026
·Updated
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts, filter rules, custom request headers and health-check URLs.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Miaomiaowuto a version that resolves this vulnerability.Fixed in 0.9.3
Event History
Oct 30, 2026
CVE Published
via MITRE·01:18 PM
Data Sourced
via MITRE·01:18 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness