Key points
- Webreaper Damselfly through version 4.5.3 has a critical authentication bypass vulnerability.
- Commented-out authorization attributes allow unauthenticated access to all API routes.
- Attackers can create administrator accounts or reset any user's password without login.
The short version
- Webreaper Damselfly versions up to 4.5.3 contain a critical authentication flaw.
- The vulnerability stems from commented-out controller authorization attributes.
- Unauthenticated attackers can gain full control by creating admin accounts.
The details
The National Vulnerability Database lists CVE-2026-111626 as a critical severity issue affecting Webreaper Damselfly through version 4.5.3. The flaw is classified under CWE-306, indicating a failure to authenticate correctly. According to the NVD record, the root cause is that controller authorization attributes have been commented out in the codebase. This configuration error allows unauthenticated attackers to access all routes under the /api/* path.
An attacker does not need valid credentials to exploit this issue. By sending a PUT request to /api/users with Admin roles, an attacker can create a new administrator account. Alternatively, a POST request to /api/users allows the attacker to reset the password of any existing user. Both actions grant the attacker full control over the application. The NVD assigns this vulnerability a CVSS score of 9.3.
The context
This vulnerability affects any organization using Webreaper Damselfly versions up to and including 4.5.3. The issue is not a complex logic error but a direct result of missing security controls in the code. Because the authorization checks are commented out, the application treats unauthenticated requests as valid. This means any system with Webreaper Damselfly exposed to a network where attackers can reach the API is at risk.
The impact is immediate and severe. Once an attacker creates an admin account or resets a password, they have complete access to the system. There is no mention in the source material of a patch or fix being available yet. Organizations must assume the vulnerability is present in all installations of the affected versions until a vendor update is confirmed.
What to watch
- Monitor vendor communications for an official patch or version update.
- Watch for unusual API traffic patterns, especially unauthenticated PUT or POST requests.
- Check logs for new administrator accounts created without prior authorization.
- Look for password reset events that do not match expected user behavior.
What it means for organisations
Teams usually need to verify if they run affected software versions immediately. Security leads should ask suppliers whether they are using this tool and if it is exposed to untrusted networks. Operations managers must determine who has administrative access and whether any recent changes match the attack pattern. Internal communications should alert IT staff to monitor for unauthorized account creation. Risk teams should assess the potential impact of full system compromise. This guidance helps organizations prioritize their response and contain potential damage without assuming a fix is ready.
What to do and how to stay safe: Webreaper Damselfly
- Identify all instances of Webreaper Damselfly in your environment and check their versions.
- Restrict network access to the application’s API endpoints to trusted sources only.
- Monitor authentication logs for successful admin account creation or password resets.
- Prepare to isolate affected systems once the vendor provides an update.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-111626 with a CVSS score of 9.3, which is critical.
Which versions of Webreaper Damselfly are affected?
All versions of Webreaper Damselfly up to and including 4.5.3 are affected by this authentication bypass.
Is there a patch available for this issue?
The source material does not mention a patch or fix; no update has been confirmed yet.
