https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T05:45:16.920413+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-110617 CVE-2026-110617 — we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint 2026-10-16T05:45:16.921997+00:00

Affected: rachelos we-mp-rss

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.