GCVE-1-2026-20137 (CVE-2026-78372)

Vulnerability from gna-1 – Published: 2026-08-24 13:09 – Updated: 2026-08-24 13:09
VLAI
Title
RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data
Summary
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The affected functionality can disclose private group or market names, ransom-note content, and metadata associated with private groups. The /compare functionality can also be queried directly with the name of a private entity, allowing an unauthorized user to retrieve information such as post counts, mirror totals, and uptime even when the entity is excluded from the normal user interface. The patch explicitly adds a privacy check before returning this information. Ransom-note views, search results, and API endpoints were similarly missing consistent filtering. The fix introduces normalized private-group identifiers and alias handling, then rejects or filters notes associated with private groups before returning them to unauthorized callers. An attacker can exploit the issue remotely without authentication or user interaction, resulting in disclosure of information that was explicitly intended to be restricted to authorized users.
Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
ransomlook ransomlook Affected: 0 , ≤ 2.0.0 (semver)
guessed Create a notification for this product.
Credits
Jeroen Pinoy Fafner [_KeyZee_]
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ransomlook",
          "repo": "https://github.com/RansomLook/RansomLook",
          "vendor": "ransomlook",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Fafner [_KeyZee_]"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRansomLook does not consistently \nenforce authorization checks when accessing groups, markets, and ransom \nnotes marked as private. An unauthenticated or otherwise unauthorized \nremote attacker can access information associated with private entities \nthrough several web views and API endpoints.\u003c/p\u003e\n\u003cp\u003eThe affected functionality can \ndisclose private group or market names, ransom-note content, and \nmetadata associated with private groups. The \u003ccode\u003e/compare\u003c/code\u003e\n functionality can also be queried directly with the name of a private \nentity, allowing an unauthorized user to retrieve information such as \npost counts, mirror totals, and uptime even when the entity is excluded \nfrom the normal user interface. The patch explicitly adds a privacy \ncheck before returning this information. \u003c/p\u003e\n\u003cp\u003eRansom-note views, search results, \nand API endpoints were similarly missing consistent filtering. The fix \nintroduces normalized private-group identifiers and alias handling, then\n rejects or filters notes associated with private groups before \nreturning them to unauthorized callers.  \u003c/p\u003e\n\u003cp\u003eAn attacker can exploit the issue \nremotely without authentication or user interaction, resulting in \ndisclosure of information that was explicitly intended to be restricted \nto authorized users.\u003c/p\u003e"
            }
          ],
          "value": "RansomLook does not consistently \nenforce authorization checks when accessing groups, markets, and ransom \nnotes marked as private. An unauthenticated or otherwise unauthorized \nremote attacker can access information associated with private entities \nthrough several web views and API endpoints.\n\n\nThe affected functionality can \ndisclose private group or market names, ransom-note content, and \nmetadata associated with private groups. The /compare\n functionality can also be queried directly with the name of a private \nentity, allowing an unauthorized user to retrieve information such as \npost counts, mirror totals, and uptime even when the entity is excluded \nfrom the normal user interface. The patch explicitly adds a privacy \ncheck before returning this information. \n\n\nRansom-note views, search results, \nand API endpoints were similarly missing consistent filtering. The fix \nintroduces normalized private-group identifiers and alias handling, then\n rejects or filters notes associated with private groups before \nreturning them to unauthorized callers.  \n\n\nAn attacker can exploit the issue \nremotely without authentication or user interaction, resulting in \ndisclosure of information that was explicitly intended to be restricted \nto authorized users."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/RansomLook/RansomLook/commit/dc92d6d5c076bcdbf3476aca42daf0260e8d99d7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-78372",
    "datePublished": "2026-08-24T13:09:11.020129Z",
    "dateReserved": "2026-08-24T13:09:20.209Z",
    "dateUpdated": "2026-08-24T13:09:20.280924Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20137"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.