CVE-2026-78370: RansomLook Information Disclosure Flaw

CVE-2026-78370 Overview

CVE-2026-78370 is a missing authorization vulnerability [CWE-862] in RansomLook, an open-source ransomware intelligence tracking application. The flaw resides in the legacy /export/<database> endpoint, which returns selected internal databases without requiring authentication. Filtering for private entities is applied inconsistently, so records marked as private in groups, markets, posts, or related tables can be included in exports served to unauthenticated requesters. An attacker with network reach to the RansomLook web application can retrieve intelligence data intentionally excluded from public views, including private ransomware intelligence, victim information, and internal tracking records.

Critical Impact
Unauthenticated remote attackers can export private RansomLook databases and disclose sensitive ransomware intelligence and victim information.

Affected Products

RansomLook ransomware intelligence application (versions prior to commit ff97a3489d70ffc3c1d09ea2c7d25137edfffb2a)
Deployments exposing the legacy /export/<database> route
API integrations relying on legacy API keys without explicit private-data grants

Discovery Timeline

2026-08-24 - CVE-2026-78370 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78370

Vulnerability Analysis

The vulnerability is a broken access control issue in the RansomLook export subsystem. The /export/<database> endpoint was designed as an unauthenticated data-sharing route for selected internal databases. Some entity databases applied limited filtering to strip records flagged as private, but this filtering was not applied consistently across every exportable database.

As a result, records intended to remain restricted, such as private groups, private posts, private markets, and associated victim entries, could be returned in full to any unauthenticated client capable of reaching the endpoint. The disclosure includes fields that the application deliberately excludes from public API responses and web views.

Exploitation requires no authentication, no user interaction, and only network access to the web application. Impact is limited to confidentiality of the exported data.

Root Cause

The root cause is missing authorization on a legacy export route combined with inconsistent enforcement of the application's private-entity policy. Authorization checks were embedded in individual view handlers rather than applied through a centralized mechanism. Databases added or refactored after the initial export logic did not inherit the private-record filter, leaving private items exposed through the export path even when the standard API and UI hid them.

Attack Vector

An attacker sends an HTTP GET request to the /export/<database> endpoint of a reachable RansomLook instance, substituting the target database name. The server returns the raw database contents, including private records that would otherwise be inaccessible without valid credentials. No session, cookie, or API key is required.

python

# Patch excerpt: ransomlook/misp_feed.py — enforce private filter on export/feed path
if target is None:
    return None

if target.get("private") is True:
    # Same rule as a private group: the victim event drops out of the
    # local pull feed as soon as the post is flagged private. Like the
    # private-group path above this calls remove(), not purge(), so an
    # already-pushed event stays on the MISP instance.
    remove(target.get("misp_uuid") or event_uuid)
    return None

if target.get("misp_uuid"):
    event_uuid = target["misp_uuid"]
# fall back to the group name as galaxy value when the group has no

Source: RansomLook security commit ff97a34

Detection Methods for CVE-2026-78370

Indicators of Compromise

Unauthenticated HTTP GET requests to paths matching /export/<database> in web server or reverse proxy logs.
Large outbound response bodies from the RansomLook application to client IPs without an established authenticated session.
Requests to the export endpoint originating from residential, hosting, or Tor exit-node ranges.

Detection Strategies

Search access logs for the /export/ URI prefix and flag any requests lacking an authenticated API key header.
Correlate export endpoint access with subsequent database dumps or bulk data transfers to external destinations.
Compare records marked private in the database against records that appeared in export responses to identify prior disclosure.

Monitoring Recommendations

Enable verbose HTTP access logging on the RansomLook front-end proxy, including full request URIs and response byte counts.
Route web application logs into a centralized SIEM or data lake and alert on export endpoint activity.
Monitor the RansomLook GitHub repository for further security commits and configuration guidance.

How to Mitigate CVE-2026-78370

Immediate Actions Required

Update RansomLook to a build that includes commit ff97a3489d70ffc3c1d09ea2c7d25137edfffb2a or later.
Restrict network access to the RansomLook web application using firewall rules, VPN, or reverse-proxy authentication until the patch is applied.
Audit existing API keys and explicitly grant private-data access only to keys that require it, as the patch does not automatically confer this privilege.

Patch Information

The fix removes the legacy unauthenticated export route and introduces centralized authorization handling that distinguishes ordinary authenticated API access from authorization to view private entries. API keys must now be explicitly granted private-data access. The same private-data filtering is applied consistently across API responses and database exports. Review the RansomLook security commit for the full patch set.

Workarounds

Block the /export/ URI prefix at a reverse proxy such as nginx or Traefik until the application is upgraded.
Require HTTP basic authentication or mutual TLS on the reverse proxy for any path exposing RansomLook.
Temporarily unset the private flag exposure risk by removing the legacy export blueprint from the application configuration.

bash

# nginx snippet: block the legacy unauthenticated export route
location ~ ^/export/ {
    return 403;
}