Misaka Danmu Server — CVE-2026-111643 (Critical)

Date Oct 16, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Misaka · Danmu Server

CVE CVE-2026-111643

Critical vendor advisory CVE-2026-111643

Summary

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Misaka Danmu Server. Patch or mitigate promptly.

Operator check

Review CVE-2026-111643 in your asset inventory. Apply patches per vendor guidance and verify Danmu Server is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-111643 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed