CVE-2026-61718: bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @loginrequired, including POST /cache/delete, allowed low-privilege read-only reader accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bunkerwebto a version that resolves this vulnerability.Fixed in 1.6.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated BunkerWeb web UI account with the low-privilege read-only reader role can exploit it. No administrator privileges or user interaction are required.
Which deployments are affected?
BunkerWeb versions from 1.6.2 until 1.6.12 are affected because the web UI authorization bypass list included the /cache/ URL prefix. The issue is fixed in version 1.6.12.
What can a reader account delete?
A reader can use POST /cache/delete to permanently delete job cache files. The affected cache content includes blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data.
How can I determine whether I am exposed?
Check whether the BunkerWeb web UI is running a version from 1.6.2 through versions before 1.6.12 and whether read-only reader accounts exist. Such accounts could access cache routes protected only by login authentication, including the cache deletion endpoint.