CVE-2026-78380

{"id": "CVE-2026-78380", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78380", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T15:19:54.618597Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/RansomLook/RansomLook/", "vendor": "ransomlook", "product": "ransomlook", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T14:17:05.667", "references": [{"url": "https://github.com/RansomLook/RansomLook/commit/133cbeab3abdd64c22b02165c6505bb3e53698cc", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which the post belongs is configured as private.\n\nAs a result, newly parsed victim information associated with a private group or market may be automatically published through enabled Rocket.Chat, Mastodon, Bluesky, and e-mail notification channels despite the entity being explicitly configured to prevent public disclosure.\n\nA similar issue affects the public MISP feed. The feed previously determined privacy using groupinfo(), which only queries the group database. Consequently, victim information associated with private markets could be added to the public MISP feed because the corresponding market privacy flag was not evaluated.\n\nAn attacker or other unauthorized party able to access these public notification channels or the MISP feed may obtain victim information that was intended to remain private. Depending on the collected data, this may disclose victim names, ransomware activity, incident information, or other information associated with privately monitored groups and markets.\n\nThe fix introduces a common is_private_entity() check covering both groups and markets and prevents private entity posts from being distributed through external notification channels or the public MISP feed. Internal storage and dashboard alerting remain unaffected."}, {"lang": "es", "value": "RansomLook no logra hacer cumplir el estado de privacidad de los grupos y mercados de ransomware al distribuir publicaciones de v\u00edctimas reci\u00e9n recopiladas a canales de notificaci\u00f3n externos. La l\u00f3gica de postprocesamiento verifica si una publicaci\u00f3n individual est\u00e1 marcada como privada, pero no verifica si el grupo o mercado al que pertenece la publicaci\u00f3n est\u00e1 configurado como privado.\n\nComo resultado, la informaci\u00f3n de v\u00edctimas reci\u00e9n analizada asociada con un grupo o mercado privado puede ser publicada autom\u00e1ticamente a trav\u00e9s de los canales de notificaci\u00f3n habilitados de Rocket.Chat, Mastodon, Bluesky y correo electr\u00f3nico, a pesar de que la entidad est\u00e9 configurada expl\u00edcitamente para evitar la divulgaci\u00f3n p\u00fablica.\n\nUn problema similar afecta la fuente p\u00fablica de MISP. La fuente determinaba previamente la privacidad usando groupinfo(), que solo consulta la base de datos de grupos. En consecuencia, la informaci\u00f3n de v\u00edctimas asociada con mercados privados podr\u00eda agregarse a la fuente p\u00fablica de MISP porque la bandera de privacidad del mercado correspondiente no fue evaluada.\n\nUn atacante u otra parte no autorizada capaz de acceder a estos canales de notificaci\u00f3n p\u00fablicos o a la fuente de MISP puede obtener informaci\u00f3n de v\u00edctimas que estaba destinada a permanecer privada. Dependiendo de los datos recopilados, esto puede revelar nombres de v\u00edctimas, actividad de ransomware, informaci\u00f3n de incidentes u otra informaci\u00f3n asociada con grupos y mercados monitoreados de forma privada.\n\nLa soluci\u00f3n introduce una verificaci\u00f3n com\u00fan is_private_entity() que cubre tanto a grupos como a mercados y evita que las publicaciones de entidades privadas sean distribuidas a trav\u00e9s de canales de notificaci\u00f3n externos o la fuente p\u00fablica de MISP. El almacenamiento interno y las alertas del panel de control permanecen inalterados."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}