CVE-2026-61718

Name of the Vulnerable Software and Affected Versions bunkerweb versions 1.6.2 through 1.6.11

Description The web UI BiscuitMiddleware authorization bypass list incorrectly included the /cache/ URL prefix. This allowed users with low-privilege read-only reader accounts to access routes in src/ui/app/routes/cache.py that were only protected by the @login required decorator. Specifically, an attacker could use the POST /cache/delete endpoint to permanently delete job cache files containing critical data such as blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data.

Recommendations Update bunkerweb to version 1.6.12.