The vulnerability lies in the TrustedNetworkAuthenticationHandler.ResolveClientIp method, which parses only the leftmost entry of the X-Forwarded-For header as the client IP. Because this header is append-only, an attacker can supply a spoofed local IP, causing the handler to treat the request as originating from a trusted network and automatically log the attacker into the Cleanuparr administrator account. This flaw enables a remote, unauthenticated attacker to acquire full administrative privileges when reverse‑proxy mode is enabled.

This issue affects all versions of Cleanuparr up to, but not including, 2.9.10. No explicit version specifications are listed beyond this patch boundary. The fix is provided in the 2.9.10 release.

The vulnerability has a CVSS score of 9.8, indicating a critical impact. No EPSS value is available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the Cleanuparr instance to run with reverse‑proxy support enabled and does not require any client authentication; by sending a crafted X-Forwarded-For header, the attacker can immediately log in as administrator over the network.