CVE-2026-13164
2026-06-24
17h16 +00:00
17h16 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Mô tả CVE
Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/views.py), exposed at POST /api/auth/register/, in MailerUp <1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, because the endpoint applies the AllowAny permission with no email verification, CAPTCHA, or administrator approval. Any account created this way can read all email stored by the instance, resulting in full disclosure of stored messages to an arbitrary unauthenticated attacker
Thông tin CVE
Điểm yếu liên quan
| Tên điểm yếu | Nguồn | |
|---|---|---|
| Missing Authentication for Critical Functionality The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
