Webreaper Damselfly: Missing authentication on REST API controllers

Summary

Damselfly, a self-hosted photo management system, through version 4.5.3 does not enforce authorization on its /api/* routes because the controller authorization attributes are commented out. An unauthenticated remote attacker can create administrator accounts via PUT /api/users or reset any user's password via POST /api/users, which gives full control of the application. The attack requires no credentials and is reachable wherever the service is accessible from outside the internal network.

Affected

• Webreaper Damselfly through 4.5.3
• Versions 0 to 4.5.3 are listed as affected in the CVE record; no version is confirmed as fixed.

Fixed in

Unknown. No vendor patch, release note or advisory naming a fixed version was found at the time of research.

Workaround

• No vendor-provided workaround found.
• Restrict access to /api/* at the reverse proxy or firewall to trusted administrator networks.
• Remove direct internet exposure and place the service behind a VPN or zero-trust access layer.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV; no evidence of exploitation in the wild found.
• VulDB states no public technical details or exploit were available at the time of research; a third-party write-up exists but was not verified.

Our recommendation

• Check whether Damselfly is reachable from the internet and, if so, restrict access immediately.
• Review the user list for unknown administrator accounts and unexpected password resets; if found, treat the instance as compromised, rebuild it from a known-good copy and rotate all credentials.
• Review logs for unauthenticated requests to /api/users from 16 October 2026 onwards.
• Monitor the vendor repository for a fixed release and update as soon as one is available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record: UserManagementController.cs (4.5.3) github.com
• CVE record: Program.cs (4.5.3) github.com
• Damselfly GitHub issue #409 github.com
• VulnCheck advisory www.vulncheck.com
• VulDB entry CVE-2026-111626 vuldb.com
• Strix CVE overview www.strix.ai
• Damselfly releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:28.