---
id: CVE-2026-55835
title: 'Lookyloo: Potential sub-system DoS due to parameter missmatch in notification'
summary: >-
  Lookyloo is a web interface that allows users to capture a website page and
  then display a tree of domains that call each other. Prior to version 1.39.4,
  an unauthenticated user can trigger Lookyloo's "report a capture" email on
  demand (…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L'
cvssSource: cna
cwe:
  - CWE-233
vendor: Lookyloo
product: lookyloo
affected:
  - lookyloo < 1.39.4
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T04:14:02.867Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-55835'
references:
  - url: >-
      https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-66gj-hmcp-5cfj
    label: >-
      https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-66gj-hmcp-5cfj
  - url: 'https://github.com/Lookyloo/lookyloo/pull/1330'
    label: 'https://github.com/Lookyloo/lookyloo/pull/1330'
  - url: >-
      https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082
    label: >-
      https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082
  - url: 'https://github.com/Lookyloo/lookyloo/releases/tag/v1.39.4'
    label: 'https://github.com/Lookyloo/lookyloo/releases/tag/v1.39.4'
tags:
  - cve.org
ingestedAt: '2026-10-23T05:16:21.503Z'
---

## Overview

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.

## Affected

- `lookyloo < 1.39.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.