Summary
CVE-2026-78370 is a missing-authorization vulnerability in RansomLook, the open-source ransomware intelligence tracking platform. The flaw resides in a legacy database export endpoint that allows unauthenticated users to retrieve internal databases — including data explicitly marked private — without any access control checks. The issue carries a CRITICAL CVSS score of 9.2 and affects RansomLook versions 0 through 2.0.0.
Technical details
- Root cause: The
/export/<database>endpoint in RansomLook’s legacy export functionality does not consistently enforce the application’s private-entity access restrictions, allowing any caller to pull internal database contents. - Trigger conditions: An attacker simply needs to send a request to the
/export/<database>route on a reachable RansomLook instance; no credentials, API key, or user interaction are required. - Attack vector: Network-based, low complexity, no privileges or user interaction required (CVSS AV:N/AC:L/AT:N/PR:N/UI:N).
- Impact: Unauthorized disclosure of sensitive ransomware intelligence, victim information, and other internal tracking records that were designated as private, resulting in high confidentiality impact to the underlying data store (VC:H, SC:H). No integrity or availability impact was reported.
- Root fix: The vendor removed the unauthenticated export route entirely and replaced it with centralized authorization logic that requires explicit private-data access grants tied to API keys, rather than relying on the legacy export path.
Affected software
- RansomLook versions 0 through 2.0.0 (inclusive), per semantic versioning.
Severity
- CVSS v4.0 Base Score: 9.2 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N - CWE-862: Missing Authorization
Mitigation and recommended actions
- Immediate: Upgrade RansomLook to a version containing the fix that removes the unauthenticated
/export/<database>route and enforces centralized, API-key-based authorization for private-data access. Confirm the deployed instance no longer exposes the legacy export endpoint after upgrading. - If immediate patching is not possible:
- Restrict network access to the RansomLook web interface and API to trusted/internal networks only (e.g., via firewall rules, VPN, or reverse-proxy allowlisting).
- Disable or block the
/export/<database>route at the reverse proxy or web server layer until the patched version is deployed. - Audit access logs for requests to
/export/paths to identify potential prior exploitation or data exfiltration attempts. - Review any data previously exposed via this endpoint and rotate/notify as appropriate if private records may have been accessed by unauthorized parties.

