Description
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.
Published: 2026-10-23
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is caused by improper handling of email and comment parameters in the /json/<uuid>/report API endpoint, which incorrectly sets the as_admin flag to True. When enabled, the system triggers a search query against a configured MISP instance and includes a list of matching URLs in an email sent to the analyst, potentially overwhelming the external MISP system and leading to a denial of service. The flaw is categorized as CWE-233, "Improper Management of Highly Sensitive Data."

Affected Systems

The issue affects the Lookyloo web interface, specifically versions of the product released prior to 1.39.4. Patch version 1.39.4 and later resolve the parameter mismatch and disable the unintended MISP query. Users running Lookyloo earlier than 1.39.4 are exposed to this DoS risk.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not currently tracked in the CISA KEV catalog. The attack vector is an unauthenticated user who can invoke the report API, which will cause the server to perform a MISP query. While no direct information leakage occurs, repeated exploitation can exhaust MISP resources, leading to a degraded or unavailable MISP service for legitimate users.

Generated by OpenCVE AI on October 23, 2026 at 05:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • If MISP integration is required, ensure it is protected behind proper authentication and rate limits to mitigate potential DoS.
  • Upgrade to Lookyloo v1.39.4 or later to apply the fix that corrects the as_admin flag handling.
  • Disable the /json/<uuid>/report API for unauthenticated users or implement an authentication layer to restrict access.

Generated by OpenCVE AI on October 23, 2026 at 05:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
First Time appeared Lookyloo
Lookyloo lookyloo
Vendors & Products Lookyloo
Lookyloo lookyloo

Fri, 23 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.
Title Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
Weaknesses CWE-233
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L'}

Subscriptions

Lookyloo Lookyloo
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-23T21:05:41.736Z

Reserved: 2026-06-17T16:29:38.865Z

Link: CVE-2026-55835

cve-icon Vulnrichment

Updated: 2026-10-23T17:33:08.796Z

cve-icon NVD

Status : Deferred

Published: 2026-10-23T05:17:15.543

Modified: 2026-10-23T21:17:24.103

Link: CVE-2026-55835

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:00:13Z

Weaknesses
  • CWE-233

    Improper Handling of Parameters