CVE-2026-92570: reNgine through 2.2.0 Unauthorized Configuration File Read
reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
reNgineto a version that resolves this vulnerability.Fixed in 2.2.0Patch reNgine through 2.2.0 - Compensating control
Restrict access to the GetFileContents API endpoint so role-based authorization checks are enforced before allowing file reads (attack is via querying the endpoint without role-based permission checks).
- Operational
Rotate any third-party API keys (e.g., SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, Hunter) that may have been exposed through unauthorized reads.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated reNgine user may be able to exploit it, including users assigned the low-privilege Auditor role. The issue is exposed through the GetFileContents API endpoint because it does not enforce role-based permission checks.
What information could be exposed?
An attacker can read bundled reconnaissance-tool configuration files. Those files may contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter.
What should teams check to determine potential exposure?
Review which authenticated users, particularly Auditor-role accounts, could have queried the GetFileContents endpoint. Also identify API keys stored in bundled recon-tool configuration files, as those are the credentials this issue can expose.