An unauthenticated flaw in the POST /fetch_cve_data endpoint allows an attacker to craft arbitrary MongoDB collection names, projection fields, and regular‑expression filters. Because input is not validated (CWE‑20), the attacker can read any document in the database, including the mgmt_users collection that stores administrative usernames and password hashes. This enables offline cracking of passwords and potential compromise of administrative accounts, representing a serious breach of confidentiality and integrity.

Every instance of cve-search that exposes the /fetch_cve_data endpoint is vulnerable. The CNA does not specify a version range, so any running cve-search instance that has not applied the patch in pull request 1218 may be affected.

The CVSS score of 9.2 classifies this as a critical vulnerability. Exploitation requires only unauthenticated network access to the HTTP /fetch_cve_data endpoint, making it a remote attack. The EPSS score is less than 1 %, indicating that, so far, the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalogue, so no known active exploits exist at present.