Refine your search
3 vulnerabilities found for SurfSense by MODSetter
CVE-2026-102245 (GCVE-0-2026-102245)
Vulnerability from cvelistv5
Published
2026-09-29 03:00
Modified
2026-10-01 15:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102245",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:39:19.173959Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:39:28.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"circleback Endpoint"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:00:15.001Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411143 | MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411143"
},
{
"name": "VDB-411143 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411143/cti"
},
{
"name": "CVE-2026-102245 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102245"
},
{
"name": "Submit #933653 | MODSetter SurfSense \u003c=0.0.36 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933653"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/1e476832e48bcdb2b4f732689dfeac0c"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102245",
"datePublished": "2026-09-29T03:00:15.001Z",
"dateReserved": "2026-09-28T18:46:21.600Z",
"dateUpdated": "2026-10-01T15:39:28.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102244 (GCVE-0-2026-102244)
Vulnerability from cvelistv5
Published
2026-09-29 02:45
Modified
2026-09-29 17:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side Request Forgery
Summary
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MODSetter | SurfSense |
Version: 0.0.1 Version: 0.0.2 Version: 0.0.3 Version: 0.0.4 Version: 0.0.5 Version: 0.0.6 Version: 0.0.7 Version: 0.0.8 Version: 0.0.9 Version: 0.0.10 Version: 0.0.11 Version: 0.0.12 Version: 0.0.13 Version: 0.0.14 Version: 0.0.15 Version: 0.0.16 Version: 0.0.17 Version: 0.0.18 Version: 0.0.19 Version: 0.0.20 Version: 0.0.21 Version: 0.0.22 Version: 0.0.23 Version: 0.0.24 Version: 0.0.25 Version: 0.0.26 Version: 0.0.27 Version: 0.0.28 Version: 0.0.29 Version: 0.0.30 Version: 0.0.31 Version: 0.0.32 Version: 0.0.33 Version: 0.0.34 Version: 0.0.35 Version: 0.0.36 cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102244",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T17:20:11.166357Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:20:26.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"Document Export Feature"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
},
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
},
{
"status": "affected",
"version": "0.0.9"
},
{
"status": "affected",
"version": "0.0.10"
},
{
"status": "affected",
"version": "0.0.11"
},
{
"status": "affected",
"version": "0.0.12"
},
{
"status": "affected",
"version": "0.0.13"
},
{
"status": "affected",
"version": "0.0.14"
},
{
"status": "affected",
"version": "0.0.15"
},
{
"status": "affected",
"version": "0.0.16"
},
{
"status": "affected",
"version": "0.0.17"
},
{
"status": "affected",
"version": "0.0.18"
},
{
"status": "affected",
"version": "0.0.19"
},
{
"status": "affected",
"version": "0.0.20"
},
{
"status": "affected",
"version": "0.0.21"
},
{
"status": "affected",
"version": "0.0.22"
},
{
"status": "affected",
"version": "0.0.23"
},
{
"status": "affected",
"version": "0.0.24"
},
{
"status": "affected",
"version": "0.0.25"
},
{
"status": "affected",
"version": "0.0.26"
},
{
"status": "affected",
"version": "0.0.27"
},
{
"status": "affected",
"version": "0.0.28"
},
{
"status": "affected",
"version": "0.0.29"
},
{
"status": "affected",
"version": "0.0.30"
},
{
"status": "affected",
"version": "0.0.31"
},
{
"status": "affected",
"version": "0.0.32"
},
{
"status": "affected",
"version": "0.0.33"
},
{
"status": "affected",
"version": "0.0.34"
},
{
"status": "affected",
"version": "0.0.35"
},
{
"status": "affected",
"version": "0.0.36"
},
{
"status": "unaffected",
"version": "0.0.36.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:45:13.530Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411142 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411142"
},
{
"name": "VDB-411142 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411142/cti"
},
{
"name": "CVE-2026-102244 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102244"
},
{
"name": "Submit #933330 | MODSetter SurfSense \u003c=0.0.36 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933330"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/57126e711507324a547edde96c62c218"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MODSetter/SurfSense/commit/2faff7b3823322a9cb6797973e6caf089386c354"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MODSetter/SurfSense/releases/tag/0.0.36.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/MODSetter/SurfSense/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102244",
"datePublished": "2026-09-29T02:45:13.530Z",
"dateReserved": "2026-09-28T18:46:17.616Z",
"dateUpdated": "2026-09-29T17:20:26.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102243 (GCVE-0-2026-102243)
Vulnerability from cvelistv5
Published
2026-09-29 02:30
Modified
2026-09-29 10:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102243",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T10:42:05.341340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T10:42:14.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"MCP Connector Integration"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:30:13.441Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411141 | MODSetter SurfSense MCP Connector Integration test command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411141"
},
{
"name": "VDB-411141 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411141/cti"
},
{
"name": "CVE-2026-102243 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102243"
},
{
"name": "Submit #933323 | MODSetter SurfSense \u003c=0.0.36 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933323"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/81504d373f4e32206dc885d3c415e278"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense MCP Connector Integration test command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102243",
"datePublished": "2026-09-29T02:30:13.441Z",
"dateReserved": "2026-09-28T18:46:14.189Z",
"dateUpdated": "2026-09-29T10:42:14.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}