CVE-2026-78372

{"id": "CVE-2026-78372", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78372", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T17:26:24.679295Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/RansomLook/RansomLook", "vendor": "ransomlook", "product": "ransomlook", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T14:17:05.260", "references": [{"url": "https://github.com/RansomLook/RansomLook/commit/dc92d6d5c076bcdbf3476aca42daf0260e8d99d7", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "RansomLook does not consistently \nenforce authorization checks when accessing groups, markets, and ransom \nnotes marked as private. An unauthenticated or otherwise unauthorized \nremote attacker can access information associated with private entities \nthrough several web views and API endpoints.\n\n\nThe affected functionality can \ndisclose private group or market names, ransom-note content, and \nmetadata associated with private groups. The /compare\n functionality can also be queried directly with the name of a private \nentity, allowing an unauthorized user to retrieve information such as \npost counts, mirror totals, and uptime even when the entity is excluded \nfrom the normal user interface. The patch explicitly adds a privacy \ncheck before returning this information. \n\n\nRansom-note views, search results, \nand API endpoints were similarly missing consistent filtering. The fix \nintroduces normalized private-group identifiers and alias handling, then\n rejects or filters notes associated with private groups before \nreturning them to unauthorized callers. \n\n\nAn attacker can exploit the issue \nremotely without authentication or user interaction, resulting in \ndisclosure of information that was explicitly intended to be restricted \nto authorized users."}, {"lang": "es", "value": "RansomLook no aplica consistentemente las comprobaciones de autorizaci\u00f3n al acceder a grupos, mercados y notas de rescate marcadas como privadas. Un atacante remoto no autenticado o de otra manera no autorizado puede acceder a informaci\u00f3n asociada con entidades privadas a trav\u00e9s de varias vistas web y puntos finales de API.\n\nLa funcionalidad afectada puede divulgar nombres de grupos o mercados privados, contenido de notas de rescate y metadatos asociados con grupos privados. La funcionalidad /compare tambi\u00e9n puede ser consultada directamente con el nombre de una entidad privada, permitiendo a un usuario no autorizado recuperar informaci\u00f3n como recuentos de publicaciones, totales de espejos y tiempo de actividad incluso cuyo la entidad est\u00e1 excluida de la interfaz de usuario normal. El parche a\u00f1ade expl\u00edcitamente una comprobaci\u00f3n de privacidad antes de devolver esta informaci\u00f3n.\n\nLas vistas de notas de rescate, los resultados de b\u00fasqueda y los puntos finales de API carec\u00edan de un filtrado consistente de manera similar. La soluci\u00f3n introduce identificadores de grupos privados normalizados y manejo de alias, luego rechaza o filtra las notas asociadas con grupos privados antes de devolverlas a los llamantes no autorizados.\n\nUn atacante puede explotar el problema de forma remota sin autenticaci\u00f3n ni interacci\u00f3n del usuario, lo que resulta en la divulgaci\u00f3n de informaci\u00f3n que estaba expl\u00edcitamente destinada a ser restringida a usuarios autorizados."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}