Vulnerability Description
An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.
Related Weaknesses (CWE)
References
- https://github.com/cve-search/cve-search/issues/1217
- https://github.com/cve-search/cve-search/pull/1218
FAQ
What is CVE-2026-59509?
CVE-2026-59509 is a documented vulnerability. An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, p...
How severe is CVE-2026-59509?
CVSS scoring is not yet available for CVE-2026-59509. Check NVD for updates.
Is there a patch for CVE-2026-59509?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.