Description
RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private.


These records could contain internal fields such as header, which may include authentication headers, session cookies, or other credentials used to access monitored websites; init_script, which may contain logic used to bypass CAPTCHA, anti-bot protections, or paywalls; and browser, which discloses details about the scraping environment.


An unauthenticated remote attacker could query the affected API endpoints and obtain these values. Leaked authentication material could potentially be replayed against the monitored service, while disclosure of scraping and bypass logic could allow site operators or other attackers to identify and defeat RansomLook's collection mechanisms.


The patch introduces an explicit allowlist of fields permitted in public location records and strips all operator-side fields before returning data to unauthenticated users.


The accompanying change from <string:postname> to <path:postname> appears to be a functional correction allowing legitimate post titles containing / and does not, based on this patch alone, represent the security issue.
Published: 2026-08-24
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized disclosure of credentials and scraping logic
Action: Immediate Patch
AI Analysis

Impact

RansomLook exposed sensitive operator‑side scraping configuration in multiple unauthenticated API responses. The API returned location records, including internal fields such as authentication headers, session cookies, init_script and browser information, to callers that were not logged in. This information disclosure allows an attacker to capture credentials that may be reused against monitored services and to learn and defeat RansomLook’s anti‑bot and captcha bypass mechanisms. The vulnerability is classified as a data confidentiality breach (CWE-200).

Affected Systems

The vulnerability affects the RansomLook platform. No specific product version was cited in the advisory, so all installations of the software that expose the described API endpoints are potentially impacted.

Risk and Exploitability

The CVSS score of 8.7 reflects a high severity data disclosure risk. The EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the weakness over the network by making unauthenticated requests to the affected API endpoints, requiring no prior access. Given the sensitive data exposed, the risk to confidentiality and the potential for later exploitation is high.

Generated by OpenCVE AI on August 24, 2026 at 20:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch that limits public location records to the allowed fields and removes operator‑side data.
  • Rotate any credentials, session tokens, or cookies that may have been exposed by the vulnerability.
  • Continuously monitor API traffic for anomalies and review access logs to ensure no unauthorized disclosure persists.

Generated by OpenCVE AI on August 24, 2026 at 20:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Ransomlook
Ransomlook ransomlook
Vendors & Products Ransomlook
Ransomlook ransomlook

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These records could contain internal fields such as header, which may include authentication headers, session cookies, or other credentials used to access monitored websites; init_script, which may contain logic used to bypass CAPTCHA, anti-bot protections, or paywalls; and browser, which discloses details about the scraping environment. An unauthenticated remote attacker could query the affected API endpoints and obtain these values. Leaked authentication material could potentially be replayed against the monitored service, while disclosure of scraping and bypass logic could allow site operators or other attackers to identify and defeat RansomLook's collection mechanisms. The patch introduces an explicit allowlist of fields permitted in public location records and strips all operator-side fields before returning data to unauthenticated users. The accompanying change from <string:postname> to <path:postname> appears to be a functional correction allowing legitimate post titles containing / and does not, based on this patch alone, represent the security issue.
Title Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API
Weaknesses CWE-200
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ransomlook Ransomlook
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-08-24T15:10:30.086Z

Reserved: 2026-08-24T13:55:50.083Z

Link: CVE-2026-78386

cve-icon Vulnrichment

Updated: 2026-08-24T15:10:23.423Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T14:17:06.090

Modified: 2026-08-26T16:49:18.760

Link: CVE-2026-78386

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T20:15:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor