Medium 4.8Published Oct 14, 2026

CVE-2026-110617we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint

Updated under an hour ago (2026-10-19 09:40 UTC)

Does this affect you?

It affects rachelos we-mp-rss. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for rachelos we-mp-rss

Exploited in the last 30 days

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.

CVSS: 4.8 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

rachelos we-mp-rss rachelos:we_mp_rss (from the name)	through 1.5.3	CNA record

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGlthird-party-advisory
https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/tools.py#L321-L376technical-description
https://github.com/rachelos/we-mp-rssproduct
https://www.vulncheck.com/advisories/we-mp-rss-through-1.5.3-missing-authorization-via-export-file-download-endpointthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.