SuggestArr: Authentication bypass via X-Forwarded-For spoofing
Summary
SuggestArr before 3.0.0 trusts the client-supplied X-Forwarded-For header to determine whether a request comes from a trusted address when local_bypass authentication mode is enabled. An unauthenticated remote attacker who can reach the web interface can send a spoofed loopback or private address and receive an administrative session. This exposes administrative endpoints such as the user list and job configurations. The attack requires local_bypass mode and a reachable instance; no credentials are needed.
Affected
- SuggestArr 1.0.4 to before 3.0.0 (CNA range, VulnCheck)
- Vendor advisory: up to and including 2.16.1
- Versions below 1.0.4: Unknown.
- Only instances with local_bypass authentication mode enabled are affected.
Fixed in
- Upgrade to SuggestArr 3.0.0 or later. Newer 3.x releases exist; the latest stable 3.x release is recommended.
- Backports to 2.x: Unknown.
Workaround
- Disable local_bypass authentication mode if it is not required.
- Restrict access to the web interface (VPN, SSO or IP allowlist at the edge).
- Ensure the reverse proxy overwrites client-supplied X-Forwarded-For headers. A proxy alone does not prevent the attack, because the header is set by the client.
Exploitation
- Proof of concept: the vendor advisory contains a proof-of-concept section; CISA SSVC data rates exploitation as 'poc'.
- Known exploitation in the wild: Not known.
- Automatable: yes.
Our recommendation
- Inventory all SuggestArr instances, including Docker and community app store installs, and record their versions.
- Upgrade to the latest 3.x release now.
- Check the authentication mode and disable local_bypass if it is not needed.
- Remove direct internet exposure or place the service behind a VPN or SSO.
- Review logs for unexpected access to /api/users or /api/jobs from unknown IP addresses.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fcjm-xhw8-pmh5 github.com
- SuggestArr v3.0.0 release github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 422896 vuldb.com
- OpenCVE CVE-2026-113703 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:16.
Original description (NVD)
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
NVD references (4)
- https://github.com/giuseppe99barchetta/SuggestArr/releases/tag/v3.0.0
- https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5
- https://www.vulncheck.com/advisories/suggestarr-before-authentication-bypass-via-x-forwarded-for-spoofing
- https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.