Description
RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism.

An unauthenticated remote attacker able to access the RansomLook web interface could therefore submit requests to this endpoint and create crypto group entries without possessing a valid authenticated session or administrative credentials.

Successful exploitation allows an attacker to make unauthorized modifications to data that should only be manageable by authenticated administrators. Depending on how crypto group information is subsequently consumed by RansomLook, malicious or fraudulent entries could also affect the integrity of information presented or processed by the application.

The vulnerability is addressed by applying the flask_login.login_required decorator to the /admin/crypto/group/new route, ensuring that only authenticated users can access the functionality.
Published: 2026-08-24
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Administration and Data Integrity Compromise
Action: Immediate Patch
AI Analysis

Impact

RansomLook’s /admin/crypto/group/new endpoint is protected by no authentication, allowing an unauthenticated attacker to post to the endpoint and create crypto group entries. Successful exploitation results in unauthorized modification of data normally restricted to administrators, potentially corrupting the integrity of group information used by the application. The vulnerability is a classic example of missing authentication (CWE‑306).

Affected Systems

The affected product is the RansomLook web application as provided by the vendor ransomlook. No specific version or patch level information is supplied. The flaw exists in any deployment that includes the unprotected /admin/crypto/group/new route.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as High severity, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified from available data. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via the web interface, where an attacker can send unauthenticated HTTP requests to the /admin/crypto/group/new endpoint. Because the endpoint accepts POST requests without session validation, exploitation requires only network connectivity to the application’s HTTP service; no special privileges are needed.

Generated by OpenCVE AI on August 24, 2026 at 17:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest RansomLook update that implements the flask_login.login_required decorator on the /admin/crypto/group/new route.
  • If an update is unavailable, add an authentication check to the route or disable the endpoint until a patch is deployed.
  • Verify that all other administrative endpoints are protected by authentication and remediate any similar missing checks.
  • Monitor web logs for unexpected group creation activity and block offending IPs if detected.

Generated by OpenCVE AI on August 24, 2026 at 17:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Ransomlook
Ransomlook ransomlook
Vendors & Products Ransomlook
Ransomlook ransomlook

Mon, 24 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Description RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker able to access the RansomLook web interface could therefore submit requests to this endpoint and create crypto group entries without possessing a valid authenticated session or administrative credentials. Successful exploitation allows an attacker to make unauthorized modifications to data that should only be manageable by authenticated administrators. Depending on how crypto group information is subsequently consumed by RansomLook, malicious or fraudulent entries could also affect the integrity of information presented or processed by the application. The vulnerability is addressed by applying the flask_login.login_required decorator to the /admin/crypto/group/new route, ensuring that only authenticated users can access the functionality.
Title Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N'}

Subscriptions

Ransomlook Ransomlook
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-08-24T17:30:00.625Z

Reserved: 2026-08-24T12:57:54.905Z

Link: CVE-2026-78369

cve-icon Vulnrichment

Updated: 2026-08-24T17:28:23.293Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T14:17:04.910

Modified: 2026-08-26T16:49:18.760

Link: CVE-2026-78369

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T17:30:06Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function