Misaka Danmu Server versions up to 2.8.9 suffer a missing authentication flaw in several /api/ui endpoints. The vulnerability permits attackers to read audit logs, diagnose server paths and environment variables, and delete episode data or clear media‑server mappings without any credentials. This can expose IP addresses, internal file system paths, and other sensitive information while also allowing attackers to alter or remove database records, compromising data integrity and availability.

All installations of Misaka Danmu Server version 2.8.9 (and potentially earlier releases) are affected because the authentication dependency is omitted for audit, diagnostics, data‑check, scan‑index, and health routes. The issue is confined to the UI API component of the server.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. Attackers can exploit the flaw simply by sending authenticated‑free HTTP requests to the exposed /api/ui routes, which is feasible for anyone with network access to the server. The impact is significant for confidentiality, integrity, and availability of the host and the data it manages.