{"id":"CVE-2026-110617","title":"we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented …","summary":"we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented …","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","cwe":["CWE-862"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T18:17:34.920","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110617","references":[{"url":"https://github.com/rachelos/we-mp-rss","label":"disclosure@vulncheck.com"},{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/tools.py#L321-L376","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGl","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/we-mp-rss-through-1.5.3-missing-authorization-via-export-file-download-endpoint","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGl","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"ingestedAt":"2026-10-14T15:36:14.007Z","slug":"CVE-2026-110617","body":"## Overview\n\nwe-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}