Critical Flaw in Misaka Danmu Server Exposes Admin Access to Attackers Without Authentication

Misaka Danmu Server through version 2.8.9 contains a critical authentication bypass vulnerability, according to the National Vulnerability Database. The flaw is tracked as CVE-2026-111643 and carries a CVSS score of 9.3, classified as Critical. It stems from a weakness categorized under CWE-306, which relates to incorrect default permissions. The issue allows unauthenticated attackers to write arbitrary configuration keys via an unprotected endpoint. No fix has been confirmed by the vendor at this time.

How it unfolded

• The National Vulnerability Database recorded CVE-2026-111643 for Misaka Danmu Server through version 2.8.9.
• The record identifies the flaw as an authentication bypass allowing unauthenticated access to configuration settings.
• Attackers can exploit the unprotected POST /api/ui/config-history/rollback endpoint to modify system keys.

Who is affected

Organizations running Misaka Danmu Server up to version 2.8.9 are affected by this vulnerability. The software is developed by l429609201. According to the NVD record, the flaw exists in the application’s handling of the config-history/rollback endpoint. This endpoint lacks proper authentication checks, exposing the system to unauthorized configuration changes. Any instance of the server running these versions is potentially vulnerable to remote exploitation without credentials.

Our take on the response

The severity of this flaw is high due to the ease of exploitation and the impact on system integrity. The ability to alter trusted proxies and API keys suggests a complete compromise of administrative controls. That suggests the risk is immediate for any exposed instance. The lack of a confirmed patch means administrators must rely on network-level mitigations. The vendor has not yet released a statement or update regarding this specific CVE.

Who needs to act first

Teams should prioritize systems exposed to the internet or untrusted networks. Check whether the application is accessible without network segmentation. Isolate affected servers from public-facing interfaces immediately. Restrict access to the API endpoint using firewall rules if possible. Review logs for unusual configuration changes. Prepare for a future update by documenting current configurations. Ensure backups are recent and verified. Monitor vendor communications for an official patch. Avoid making changes to the live environment until a fix is available.

Background: Firewall rules

Firewall rules Linux systems use are ordered instructions that decide whether network packets enter or leave. They inspect source, destination, and protocol data. You must configure these rules to allow necessary services while blocking unauthorized access attempts.

Read the full guide: Firewall Rules Linux: How Packet Filtering Shapes Network Security

What to do and how to stay safe: Misaka Danmu Server

• Block access to the /api/ui/config-history/rollback endpoint at the firewall or web application firewall level.
• Implement strict IP whitelisting for any management interfaces if the application allows it.
• Monitor server logs for unauthorized POST requests to configuration endpoints.
• Once the vendor provides an update, test it in a staging environment before deployment.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111643?

The National Vulnerability Database rates CVE-2026-111643 with a CVSS score of 9.3, which is classified as Critical.

Which versions of Misaka Danmu Server are vulnerable?

Versions of Misaka Danmu Server up to and including 2.8.9 are affected by this authentication bypass vulnerability.

Has a patch been released for this issue?

No, the source material does not indicate that a patch or fix has been confirmed or released by the vendor.