Summary
CVE-2026-78369 is a missing-authentication vulnerability (CWE-306) in RansomLook, an open-source ransomware-tracking platform. The /admin/crypto/group/new administrative endpoint fails to enforce authentication, allowing unauthenticated network attackers to create new cryptocurrency group entries that were intended to be restricted to logged-in administrators. The flaw is rated HIGH severity (8.8) and affects RansomLook versions up to and including 2.0.0.
Technical details
- Root cause: The Flask route handler for
/admin/crypto/group/newinwebsite/web/__init__.pywas not decorated with an authentication check (@flask_login.login_required), leaving the endpoint open to any caller. - Trigger conditions: An attacker simply needs network access to the RansomLook web application; no valid session, credentials, or prior authentication is required.
- Attack vector: Network (remote), low attack complexity, no privileges or user interaction required — the endpoint accepts both GET and POST requests without verifying the caller’s identity.
- Impact: Unauthenticated users can create arbitrary cryptocurrency group records, compromising the integrity of administrative data managed by RansomLook. Depending on how downstream consumers trust this data, this could also affect data availability for the crypto-group functionality.
Affected software
- RansomLook (github.com/RansomLook/RansomLook) — versions 0 through 2.0.0 (inclusive)
Severity
- CVSS Score: 8.8 (HIGH)
- CVSS Vector (v4.0):
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N - CWE: CWE-306 – Missing Authentication for Critical Function
Mitigation and recommended actions
- Immediate: Upgrade RansomLook beyond version 2.0.0 to a release that includes the fix applied in commit
fc25bc4f3d42d3440f9760702c3a5be138bc56a3, which adds alogin_requiredauthentication check to theadmin_crypto_group_new()handler. - If unable to patch immediately:
- Restrict network access to the RansomLook
/admin/path (e.g., via reverse proxy allow-listing, VPN, or firewall rules) so it is reachable only by trusted administrative hosts. - Place the application behind an authenticating reverse proxy or WAF that enforces authentication on all
/admin/*routes as a compensating control. - Audit existing cryptocurrency group records for unauthorized or unexpected entries created since deployment.
- Restrict network access to the RansomLook

