CVE-2026-113703SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
Updated under an hour ago ()
Does this affect you?
It affects giuseppe99barchetta SuggestArr. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
- CVSS
- 9.3 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- Weakness (CWE)
- CWE-290
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 20, 2026
- First seen by InfoSec Signals
- Oct 20, 2026
Affected products
giuseppe99barchetta SuggestArr giuseppe99barchetta:suggestarr (from the name) | from 1.0.4 before 3.0.0 | CNA record |
References
- https://github.com/giuseppe99barchetta/SuggestArr/releases/tag/v3.0.0release-notes, patch
- https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5vendor-advisory
- https://www.vulncheck.com/advisories/suggestarr-before-authentication-bypass-via-x-forwarded-for-spoofingthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.