CVE-2026-129468

Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line

Published Nov 15, 2026 CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Description

Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line that allows restricted users to access domains outside their permissions. Restricted sub-users or single-domain logins can iterate the domain_id parameter to enumerate panel domain ids and read each domain's DNS line list and default line.

Analysis

Technical impact

Netcccyun dnsmgr 2.18 through 2.21 contains a missing authorization flaw in the POST /cloudflare/get_domain_default_line endpoint. The flaw allows users with limited permissions to read DNS line lists and default lines for domains beyond their own scope by iterating the domain_id parameter. This bypass results in disclosure of configuration information that should be restricted, compromising data confidentiality for all domains managed by the platform.

Affected Systems

The vulnerability affects Netcccyun dnsmgr versions 2.18 through 2.21. Users of these releases who rely on fine‑grained access controls for Cloudflare integration are potentially exposed.

Risk and Exploitability

The CVSS base score of 5.3 places this bug in the medium severity range, and the EPSS score is currently unavailable, indicating no publicly known exploit prevalence. The issue is not listed in CISA's KEV catalog. While the vulnerability is accessed via HTTP POST, it requires only authenticated access to the application, so remote attackers who can log in as restricted users may enumerate domain identifiers and retrieve sensitive DNS configurations. The missing authorization check is the critical weakness identified by CWE-862.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

netcccyun

dnsmgr

unaffected

Version	Status	Constraints
`2.18`	affected	< 2.22

No data.

Vendor Product Versions

Netcccyun

Dnsmgr

Version	Status	Scheme	Platform
`[2.18,2.22)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Netcccyun dnsmgr to version 2.22 or later where the authorization check has been added to /cloudflare/get_domain_default_line.
Enable or enforce least‑privilege user permissions so that the POST endpoint is only reachable by users with explicit domain ownership rights. This can be enforced by configuring IAM or role‑based access controls within dnsmgr.
If an upgrade is not yet possible, restrict the get_domain_default_line route to authenticated users only and implement a server‑side validation that ensures the domain_id belongs to the caller’s permitted domain list.

Generated by OpenCVE AI on November 15, 2026 at 14:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/netcccyun/dnsmgr/blob/b42dbcf88bccca287e9e9af53e87ba399a5ae295/app/controller/Cloudflare.php#L381-L398
https://github.com/netcccyun/dnsmgr/commit/175468c6423c04a6b46e56663c37f090bef5381f
https://github.com/netcccyun/dnsmgr/issues/580
https://hackmd.io/@hieund/dnsmgr-cloudflare-default-line-missing-authz-cross-tenant-idor
https://www.vulncheck.com/advisories/netcccyun-dnsmgr-2.18-before-2.22-missing-authorization-via-get-domain-default-line

History

Nov 15, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Netcccyun Netcccyun dnsmgr
Vendors & Products		Netcccyun Netcccyun dnsmgr

Nov 15, 2026 1:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line that allows restricted users to access domains outside their permissions. Restricted sub-users or single-domain logins can iterate the domain_id parameter to enumerate panel domain ids and read each domain's DNS line list and default line.
Title		Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line
Weaknesses		CWE-862
References		https://github.com/netcccyun/dnsmgr/blob/b42dbcf88bccca287e9e9af53e87ba399a5ae295/app/controller/Cloudflare.php#L381-L398 https://github.com/netcccyun/dnsmgr/commit/175468c6423c04a6b46e56663c37f090bef5381f https://github.com/netcccyun/dnsmgr/issues/580 https://hackmd.io/@hieund/dnsmgr-cloudflare-default-line-missing-authz-cross-tenant-idor https://www.vulncheck.com/advisories/netcccyun-dnsmgr-2.18-before-2.22-missing-authorization-via-get-domain-default-line
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`