CVE-2026-78372: RansomLook Information Disclosure Flaw

CVE-2026-78372 Overview

CVE-2026-78372 is a missing authorization vulnerability [CWE-862] in RansomLook, an open-source ransomware group and leak-site tracker. The application fails to consistently enforce authorization checks on web views and API endpoints that expose groups, markets, and ransom notes marked as private. An unauthenticated remote attacker can retrieve private group and market names, ransom-note contents, and associated metadata by querying affected endpoints directly. The /compare endpoint accepts the name of a private entity and returns post counts, mirror totals, and uptime data even when the entity is hidden from the standard interface.

Critical Impact
Unauthenticated remote attackers can disclose the contents and metadata of RansomLook entries explicitly marked private, defeating the application's privacy controls.

Affected Products

RansomLook (open-source ransomware tracking platform)
Deployments prior to commit dc92d6d5c076bcdbf3476aca42daf0260e8d99d7
Self-hosted RansomLook instances exposing web and API endpoints

Discovery Timeline

2026-08-24 - CVE-2026-78372 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78372

Vulnerability Analysis

RansomLook classifies certain groups, markets, and ransom notes as private so they are excluded from the public interface. The application implements this filtering inconsistently across code paths. Several web views, search results, and API endpoints return data associated with private entities when queried directly by name or identifier. The /compare endpoint accepts a caller-supplied entity name and returns post counts, mirror totals, and uptime information without verifying whether the target entity is private. Ransom-note views and search results similarly return records tied to private groups when no authorization filter is applied.

Root Cause

The root cause is missing authorization [CWE-862]. Privacy filtering was implemented at the presentation layer for standard listings but was not enforced at the underlying view, search, and API handlers. Private-group identifiers were also stored in inconsistent forms, so name-based lookups bypassed filtering that relied on exact matches.

Attack Vector

Exploitation requires only network access to the affected RansomLook instance. An attacker submits requests to endpoints such as /compare or ransom-note views using the name or slug of a private entity. The server returns the associated data without authentication or authorization checks.

python

# Security patch in ransomlook/sharedutils.py
# Adds regex import used to normalize private-group identifiers
 import glob
 import json
+import re
 import sys
 from collections.abc import Iterator
 from datetime import datetime, timedelta

# Security patch in website/web/__init__.py
# Imports get_private_note_slugs to filter private groups
# out of /compare and ransom-note views
     createfile,
     cryptostats,
     currentmonthstr,
+    get_private_note_slugs,
     groupcount,
     hostcount,
     hostcountadmin,

Source: RansomLook commit dc92d6d

Detection Methods for CVE-2026-78372

Indicators of Compromise

Web server access logs showing requests to /compare with query parameters containing names of entities configured as private.
Requests to ransom-note view or search endpoints referencing slugs of groups marked private in the local configuration.
Sequential enumeration patterns from a single source across group, market, and note endpoints.

Detection Strategies

Review HTTP access logs for unauthenticated requests targeting /compare, note views, and API endpoints that return group or market data.
Cross-reference requested entity names against the private-group configuration to identify queries against restricted entries.
Alert on high-rate or scripted access patterns from a single client to the RansomLook web tier.

Monitoring Recommendations

Enable verbose request logging on the reverse proxy or web server fronting RansomLook.
Forward web and API logs to a centralized analytics platform and build queries that join request URIs with the list of private-group slugs.
Monitor for unusual spikes in queries to comparison, search, and note-retrieval endpoints.

How to Mitigate CVE-2026-78372

Immediate Actions Required

Update RansomLook to the revision containing commit dc92d6d5c076bcdbf3476aca42daf0260e8d99d7 or later.
Restrict network access to the RansomLook web interface until the patch is applied.
Audit historical access logs for requests referencing private-group names or slugs.

Patch Information

The upstream fix is available in the RansomLook repository. The patch introduces normalized private-group identifiers and alias handling, adds a get_private_note_slugs helper, and enforces a privacy check in the /compare handler, ransom-note views, search results, and related API endpoints before returning data. Details are available in the RansomLook security commit.

Workarounds

Place the RansomLook web tier behind an authenticated reverse proxy that requires credentials for all requests.
Use web server rules to deny access to /compare, note view, and search endpoints from untrusted networks until the upstream fix is deployed.
Temporarily remove private entries from the deployment if the instance must remain publicly reachable before patching.

bash

# Example nginx rule restricting sensitive endpoints to trusted networks
location ~ ^/(compare|notes|search) {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://ransomlook_backend;
}