CVE-2026-113703

Name of the Vulnerable Software and Affected Versions SuggestArr versions prior to 3.0.0

Description An authentication bypass exists in the local bypass authentication mode. The enforce authentication() function in api service/auth/middleware.py trusts the request.remote addr value, which is derived from the spoofable X-Forwarded-For header due to the ProxyFix(x for=1) configuration in api service/app.py. An attacker can spoof a trusted CIDR address, such as 127.0.0.1, via the X-Forwarded-For header to be granted an unauthenticated admin session through the load bypass user context() function. This allows full administrative access to endpoints including '/api/users' and '/api/jobs' without credentials.

Recommendations Update to version 3.0.0 or later. As a temporary mitigation, restrict access to the '/api/users' and '/api/jobs' endpoints or disable the local bypass authentication mode.