CVE-2026-73405

Name of the Vulnerable Software and Affected Versions Vulnerability-Lookup (affected versions not specified)

Description An authorization bypass exists due to inconsistent enforcement between the REST API and the Server-Sent Events (SSE) streaming interface. The Pub/Sub interface uses a token required decorator that authenticates requests by matching the X-API-KEY header against a user API key but fails to verify if the account is active or confirmed. Since API keys are issued during self-registration before confirmation is complete, unauthorized users can access the /pubsub/subscribe/<topic> endpoint. This allows access to stream events, such as unmoderated comments, that are otherwise restricted via the REST API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.