CVE-2026-125750 | BDVDB-2026-402988 Detail
firekylinFirekylin
Description#
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-862 Missing Authorization
References#
- https://github.com/firekylin/firekylin/issues/975
- https://github.com/firekylin/firekylin/pull/976
- https://github.com/firekylin/firekylin/blob/2.18.1/src/controller/admin/api/base.js#L69-L77
- https://github.com/firekylin/firekylin/blob/2.18.1/src/controller/admin/api/options.js#L12-L41
- https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure
- https://www.vulncheck.com/advisories/firekylin-through-2.18.1-improper-authorization-via-admin-rest-api-get-actions
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.