CVE-2026-78380: RansomLook Information Disclosure Vulnerability

CVE-2026-78380 Overview

CVE-2026-78380 is a missing authorization flaw [CWE-862] in RansomLook, an open-source ransomware tracking tool. The vulnerability causes newly parsed victim posts associated with private groups or markets to be distributed through external notification channels and the public MISP feed. RansomLook's post-processing logic checks only whether an individual post is marked private and does not verify the privacy status of the parent group or market. As a result, victim data that operators explicitly configured to remain internal can leak to Rocket.Chat, Mastodon, Bluesky, e-mail subscribers, and public MISP consumers.

Critical Impact

Unauthorized third parties consuming the public notification channels or MISP feed may obtain victim names, ransomware activity details, and incident information tied to privately monitored groups and markets.

Affected Products

• RansomLook (open-source ransomware tracking project)
• RansomLook MISP feed integration (ransomlook/misp_feed.py)
• RansomLook notification integrations for Rocket.Chat, Mastodon, Bluesky, and e-mail (ransomlook/posts.py)

Discovery Timeline

• 2026-08-24 - CVE-2026-78380 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78380

Vulnerability Analysis

RansomLook aggregates ransomware leak site content and distributes new victim posts through configurable notification channels and a public MISP feed. Each ransomware group and marketplace entity carries a privacy flag that determines whether its contents can be shared externally. The post-processing pipeline evaluated privacy at the wrong scope: it inspected the post record but never re-checked the parent group or market entity. Posts inherit visibility from the tracked entity, so this scoping error creates an authorization gap where private-entity data reaches public sinks.

The MISP feed exhibited a related defect. Its privacy determination relied on groupinfo(), which queries only the group database. Markets configured as private were therefore not evaluated at all, and their victim entries were pushed to the public feed.

Root Cause

The underlying issue is missing authorization [CWE-862] at the entity level. The privacy check was applied to individual post objects rather than to the entity that owns them. Neither the notification broadcaster in ransomlook/posts.py nor the MISP publisher in ransomlook/misp_feed.py enforced a unified privacy contract covering both groups and markets.

Attack Vector

An unauthorized party does not need to attack the RansomLook instance directly. Any subscriber to an affected notification channel or consumer of the public MISP feed can passively receive victim information intended to remain private. Operators of RansomLook deployments that subscribe private entities are the primary source of exposure.

# Patch: introduce shared is_private_entity() helper in misp_feed.py
 from .default import DB_ACTORS, DB_GROUPS, DB_MARKETS, DB_MISP, DB_POSTS
 from .default.config import get_config, get_socket_path
 from .misp import delete_event, push_event
-from .sharedutils import errlog
+from .sharedutils import errlog, is_private_entity

 # Fixed namespace for deterministic UUIDs. NEVER change this value.
 NS = uuidlib.UUID("6f2b1e2a-9c3d-5a41-b7e8-0d1c2f3a4b5c")

Source: RansomLook commit 133cbeab

# Patch: gate external notifications in posts.py on entity privacy
 from ransomlook.mastodon import tootnotify
 from ransomlook.misp_feed import refresh_victim
 from ransomlook.rocket import rocketnotify
-from ransomlook.sharedutils import dbglog, errlog, stdlog
+from ransomlook.sharedutils import dbglog, errlog, is_private_entity, stdlog

 logger = get_logger("posts")

Source: RansomLook commit 133cbeab

The fix imports the new is_private_entity() helper into both modules and short-circuits distribution when either the parent group or the parent market is marked private.

Detection Methods for CVE-2026-78380

Indicators of Compromise

• Posts referencing groups or markets flagged private in the RansomLook configuration appearing on connected Rocket.Chat rooms, Mastodon accounts, Bluesky handles, or subscribed e-mail addresses.
• MISP events sourced from the RansomLook public feed containing victim entries whose parent market carries a private flag in the local database.
• Notification bot activity timestamps that correlate with parser runs against privately tracked entities.

Detection Strategies

• Diff the current RansomLook posts.py and misp_feed.py against pre-patch versions to confirm whether is_private_entity() gating is present.
• Query the local RansomLook database for groups and markets where the private attribute is true, then search downstream notification archives for references to those entity names.
• Enumerate MISP events published from the RansomLook feed and cross-reference their group and market tags with private entries in DB_GROUPS and DB_MARKETS.

Monitoring Recommendations

• Log all outbound notification attempts with the associated group and market identifiers to allow retrospective privacy audits.
• Alert when a notification handler processes a post whose parent entity has the private flag set.
• Review MISP feed publication logs after each parser cycle to detect events tied to private markets.

How to Mitigate CVE-2026-78380

Immediate Actions Required

• Update RansomLook to the revision containing commit 133cbeab3abdd64c22b02165c6505bb3e53698cc or later, which introduces the shared is_private_entity() check.
• Temporarily disable Rocket.Chat, Mastodon, Bluesky, and e-mail notification integrations until the patch is applied if private entities are being tracked.
• Purge or retract MISP events that were published from private markets while the vulnerable code was running.

Patch Information

The fix is provided in the RansomLook repository through commit 133cbeab3abdd64c22b02165c6505bb3e53698cc. It adds a common is_private_entity() function that evaluates both the group and market privacy flags and blocks external distribution when either is set. Internal storage and dashboard alerting are unaffected by the change.

Workarounds

• Set all currently private groups and markets to a disabled or non-tracked state until RansomLook is upgraded.
• Comment out or unconfigure the rocketnotify, tootnotify, Bluesky, and e-mail handlers invoked from ransomlook/posts.py.
• Restrict outbound network egress from the RansomLook host to prevent unpatched instances from reaching notification endpoints or the public MISP feed URL.

# Apply the upstream fix
git fetch origin
git checkout main
git pull
git log --oneline | grep 133cbeab

# Optional: verify the helper is imported where required
grep -R "is_private_entity" ransomlook/posts.py ransomlook/misp_feed.py