CVE-2026-78369

Name of the Vulnerable Software and Affected Versions RansomLook (affected versions not specified)

Description A missing authentication flaw exists in the '/admin/crypto/group/new' endpoint. This endpoint, intended for the administrative creation of new crypto group entries, lacks protection from the application's authentication mechanism. An unauthenticated remote attacker with access to the web interface can submit requests to this endpoint to create crypto group entries without a valid session or administrative credentials. This allows unauthorized modifications to data restricted to administrators and may compromise the integrity of information processed or presented by the application.

Recommendations Apply the flask login.login required decorator to the '/admin/crypto/group/new' route to ensure only authenticated users can access this functionality.