CVE-2026-102245

Name of the Vulnerable Software and Affected Versions MODSetter SurfSense versions prior to 2.0.4

Description A weakness in the circleback Endpoint, specifically within an unknown function of the file surfsense backend/app/routes/circleback webhook route.py, allows for missing authentication. This issue enables a remote attacker to perform manipulations that bypass authentication requirements.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.