https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 14:14:13 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-121139 <p>The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated &#34;bootstrap&#34; exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken&#39;s administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.</p> <p>This issue has been fixed in version 6.5.9.</p> <p>The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated &#34;bootstrap&#34; exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken&#39;s administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.</p> <p>This issue has been fixed in version 6.5.9.</p> https://db.gcve.eu/vuln/fkie_cve-2026-121139 https://db.gcve.eu/vuln/ghsa-9hfj-jg3v-c22g <p>The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated &#34;bootstrap&#34; exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken&#39;s administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.</p> <p>This issue has been fixed in version 6.5.9.</p> <p>The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated &#34;bootstrap&#34; exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken&#39;s administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.</p> <p>This issue has been fixed in version 6.5.9.</p> https://db.gcve.eu/vuln/ghsa-9hfj-jg3v-c22g