A flaw in cve‑search’s POST /fetch_cve_data endpoint allows an attacker to supply arbitrary values for the MongoDB collection name, projected fields, and regular‑expression filters. Because the input is not properly validated (CWE‑20), the attacker can read any document in the database, including sensitive data such as usernames and hashed passwords from the mgmt_users collection. The vulnerability enables offline password cracking and the potential compromise of administrative accounts, representing a serious breach of confidentiality and integrity.

Every instance of cve‑search that exposes the /fetch_cve_data endpoint is vulnerable. The CNA does not provide a specific version range, so any running instance that has not applied the patch from the referenced pull request may be affected.

The CVSS score of 9.2 classifies this as a critical vulnerability. Exploitation requires only unauthenticated network access to the HTTP endpoint, making it a remote, local‑scope attack. The EPSS score is less than 1 %, indicating that, so far, the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalogue, so no known active exploits exist at present.