CVE-2026-78387: RansomLook Auth Bypass Vulnerability

CVE-2026-78387 Overview

CVE-2026-78387 is a missing authorization vulnerability [CWE-862] in RansomLook, an open-source ransomware intelligence tracking application. The flaw resides in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint validates that a session is authenticated but does not verify administrator privileges before granting access to configuration management functionality. Any low-privileged authenticated user can therefore modify sensitive application settings including notification, LDAP, SMTP, and general configuration values written directly to config/generic.json.

Critical Impact
An authenticated low-privileged attacker can rewrite RansomLook's core configuration file, redirect notifications, tamper with authentication settings, disrupt integrations, or render the deployment unavailable.

Affected Products

RansomLook (open-source ransomware tracker)
Versions prior to commit d411ff51446e9e8b04e15567b46d53e86a3116dd
Deployments exposing the /admin/config route to authenticated users

Discovery Timeline

2026-08-24 - CVE-2026-78387 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78387

Vulnerability Analysis

RansomLook exposes a web UI route at /admin/config that renders a configuration editor and accepts write operations against the on-disk configuration file config/generic.json. The route is gated only by a session authentication check. It does not enforce a role or privilege check before dispatching the request to the configuration-editing handlers.

An attacker with any authenticated account can submit crafted values that overwrite notification endpoints, LDAP bind parameters, SMTP relay settings, and general application options. Because the same configuration file stores passwords, tokens, secrets, and API keys, the editor also handles sensitive material. The affected version includes filtering intended to avoid returning known secret values to the browser, but this control does not prevent an authenticated non-admin from writing new values.

Root Cause

The root cause is missing authorization [CWE-862] in the route handler backing /admin/config. Authentication is treated as sufficient for privileged configuration management, violating least-privilege enforcement. The route also mixes read and write operations on secret-bearing data through a browser-facing interface, expanding the blast radius of any compromised or low-privileged account.

Attack Vector

Exploitation requires network access to the RansomLook web interface and valid credentials for any account. The attacker navigates to /admin/config (or issues equivalent HTTP requests) and submits configuration values. Successful writes are persisted to config/generic.json and take effect according to how the application reloads configuration. Impact scenarios include redirecting SMTP or webhook notifications to attacker-controlled destinations, modifying LDAP settings to influence authentication behavior, and corrupting configuration to cause denial of service.

text

// Patch reference from website/web/sri.txt: config.js SRI entry removed
-    "config.js": "JuzNmf/ix5UYGd+6scfsWZI2rGITXV15OlscFt7AysEq/z+t6K/lYwysPsUKlIGe6xhzWtEurrHZd+mwh7WLoQ==",
-    "crypto.js": "JoC0vDSLyg12A5A9yJG58VItzrPwnGb6BfW0Akb1TzCPXelTp9PmfazkUpDytpChq4wxOHiFuRjASVerJkFpFg==",
+    "crypto.js": "7ipX9+WbFwJIRH2Ec2SwZN9mIFgHU5SxKBFNMRIbWtIhp1g/imsTxqjUxqbd/Wko2tgaqSJLpCrZAMfuePH86g==",
// Source: https://github.com/RansomLook/RansomLook/commit/d411ff51446e9e8b04e15567b46d53e86a3116dd

The removed config.js (shown below) implemented the client-side configuration editor interactions, including password-visibility toggles that surfaced secret values in the browser.

javascript

-document.addEventListener('DOMContentLoaded', () => {
-  // Collapsible sections
-  document.querySelectorAll('.js-collapse-toggle').forEach(hd => {
-    hd.addEventListener('click', () => {
-      const body = hd.nextElementSibling;
-      if (!body || !body.classList.contains('collapse-body')) return;
-      const hidden = body.hasAttribute('hidden');
-      body.toggleAttribute('hidden');
-      const arrow = hd.querySelector('.collapse-arrow');
-      if (arrow) arrow.textContent = hidden ? '▾' : '▸';
-    });
-  });
-
-  // Toggle password visibility
-  document.querySelectorAll('.js-toggle-pw').forEach(btn => {
-    btn.addEventListener('click', () => {
-      const input = document.getElementById(btn.dataset.target);
-      if (!input) return;
-      const isPw = input.type === 'password';
-      input.type = isPw ? 'text' : 'password';
-      btn.textContent = isPw ? 'Hide' : 'Show';
-    });
-  });
-});
// Source: https://github.com/RansomLook/RansomLook/commit/d411ff51446e9e8b04e15567b46d53e86a3116dd

Detection Methods for CVE-2026-78387

Indicators of Compromise

HTTP requests from non-administrator sessions to /admin/config on the RansomLook web application.
Unexpected modifications to config/generic.json, especially to notification, LDAP, or SMTP sections.
New or altered outbound SMTP relays, webhook URLs, or LDAP endpoints appearing in application logs.
Authentication anomalies coinciding with LDAP configuration changes.

Detection Strategies

Enable and review web server access logs for GET and POST requests to /admin/config and correlate with session user roles.
Monitor file integrity on config/generic.json and alert on writes outside of controlled deployment workflows.
Alert on outbound connections to previously unseen SMTP, webhook, or LDAP destinations originating from the RansomLook host.

Monitoring Recommendations

Forward application, web server, and file-integrity events to a centralized log platform for correlation.
Baseline expected values for notification, SMTP, and LDAP configuration and diff on each application restart.
Track authentication failure and success ratios after any configuration change to detect malicious LDAP tampering.

How to Mitigate CVE-2026-78387

Immediate Actions Required

Update RansomLook to a version that includes commit d411ff51446e9e8b04e15567b46d53e86a3116dd, which removes the /admin/config route.
Rotate all secrets previously stored in config/generic.json, including SMTP credentials, LDAP bind passwords, API keys, and tokens.
Audit config/generic.json for unauthorized modifications since the endpoint was first exposed.
Review and disable any low-privileged accounts that no longer require access.

Patch Information

The fix is delivered in the upstream repository as commit d411ff51446e9e8b04e15567b46d53e86a3116dd. The patch removes the /admin/config route, deletes the associated config.js client-side editor, and updates website/web/sri.txt to drop the Subresource Integrity entry for the removed script. After patching, application configuration must be managed by editing config/generic.json directly on the server rather than through the web UI. See the RansomLook security commit for details.

Workarounds

Restrict network access to the RansomLook web interface to trusted administrators via reverse proxy ACLs or VPN gating.
Block the /admin/config path at the reverse proxy or WAF until the patched version is deployed.
Enforce strict authentication and remove any shared or unnecessary user accounts on the RansomLook instance.
Set filesystem permissions on config/generic.json so the application user cannot write to it outside of deployment operations.

bash

# Example nginx snippet to block the vulnerable endpoint pre-patch
location = /admin/config {
    deny all;
    return 403;
}