Vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed (CVE-2026-73405)
Summary
Vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed (CVE-2026-73405). Risk of unauthorized operations or information disclosure. Exploitable via X-API-Key header.
Original description
The description as published by the source.
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/ endpoint.
The token_required decorator used by the Pub/Sub interface authenticated requests solely by matching the X-API-KEY header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account's is_active and is_confirmed state.
Because the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments.
The vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface.
The patch corrects the issue by requiring accounts to be both active and confirmed before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API.
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-73405 has been found in Vulnerability-Lookup allowed inactive or unconfirmed.
Attackers can target a specific entry point like X-API-Key header over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Vulnerability-Lookup allowed inactive or unconfirmed CVE-2026-73405" on the vendor's site.
CVE-2026-73405 (Vulnerability-Lookup allowed inactive or unconfirmed) — CWE-862
Attack surface: X-API-Key header
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-862) exists in Vulnerability-Lookup allowed inactive or unconfirmed. Attackers reach the vulnerable code path via X-API-Key header.
Check the vendor advisory for the affected versions of Vulnerability-Lookup allowed inactive or unconfirmed. Attack surface: X-API-Key header.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで Vulnerability-Lookup allowed inactive or unconfirmed を使っているサービスとバージョンを洗い出す。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com