CVE-2026-92570CWE-862broken-access-control

CVE-2026-92570

Medium · published September 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-16T19:19Z
References (6)
https://github.com/yogeshojha/rengine · [email protected]https://github.com/yogeshojha/rengine/blob/302b5f32e7aa5958fec9e405772f4aa069eb21a2/web/api/views.py#L1607-L1700 · [email protected]https://github.com/yogeshojha/rengine/blob/302b5f32e7aa5958fec9e405772f4aa069eb21a2/web/reNgine/settings.py#L129-L141 · [email protected]https://github.com/yogeshojha/rengine/issues/1554 · [email protected]https://www.vulncheck.com/advisories/rengine-through-2.2.0-unauthorized-configuration-file-read · [email protected]https://github.com/yogeshojha/rengine/issues/1554 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 14:40Z
    reNgine through 2.2.0 Unauthorized Configuration File Read
    cvelistv5