CVE-2026-54551: WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)
WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated and forwards every TrafficDelta event without per-user authorization in handleWebsocket(). A low-privilege user can enumerate peer public keys through EntityId and monitor BytesReceived and BytesTransmitted values for peers belonging to other users. The same connection exposes interfacestats and interface names that the REST API limits to administrators. Tunnel content, AllowedIPs, and user identities remain authorization-gated. This issue is fixed in version 2.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wg-portalto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege wg-portal user can exploit it. No administrator privileges or user interaction are required.
What information can an affected user obtain?
The WebSocket can expose other users' peer public keys and received/transmitted byte counters, as well as interface statistics and interface names. It does not expose tunnel content, AllowedIPs, or user identities.
Which deployments are affected?
wg-portal versions from 2.2.0 up to, but not including, 2.3.0 are affected. The issue is fixed in version 2.3.0.
How can I determine whether users may already have accessed this data?
Review whether the affected deployment permitted low-privilege authenticated users to connect to GET /api/v0/ws. The provided information does not identify specific logging or audit records that would confirm prior access.