A weakness exists in the circleback Endpoint of MODSetter SurfSense (versions up to 2.0.3) in the file circleback_webhook_route.py. The flaw allows an attacker to perform manipulation that bypasses authentication, resulting in unauthenticated access to the endpoint. Once this vulnerability is exploited, the attacker can invoke the protected route without valid credentials. The actual payload or impact of the exfiltration or manipulation performed by the endpoint is not detailed in the advisory, so the specific data or system changes an attacker can achieve are unknown. The vulnerability is a classic authentication bypass (CWE‑287).

MODSetter SurfSense versions 2.0.3 and earlier are affected. Any deployment of the Surfsense backend that includes the circleback Endpoint component may be vulnerable to this flaw.

The CVSS score of 6.9 indicates a moderate level of severity. No EPSS score is available, but the exploit has been released publicly and can be launched remotely via the exposed route. The vulnerability is not listed in CISA’s KEV catalog. Attackers could target the vulnerable endpoint over the network, and because the authentication is missing, any request to the route can be processed without valid credentials.