🔴 《严重安全漏洞：CVE-2026-58466》

CVSS 评分: 严重（9.3）　　状态: Received　　发布时间: 2026-07-02

---

英文原文描述

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.

---

🔍 技术细节

字段	值
CVE ID	CVE-2026-58466
CVSS 评分	9.3 🔴
严重程度	严重
CVSS 向量	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类	CWE-1392
发布时间	2026-07-02
最后更新	2026-07-02
状态	Received
数据来源	disclosure@vulncheck.com

---

🔗 参考链接

• https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73

• https://github.com/EstrellaXD/Auto_Bangumi/issues/1041

• https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8

• https://www.vulncheck.com/advisories/autobangumi-hard-coded-default-credentials-via-add-default-user

• NVD 正式页面: https://nvd.nist.gov/vuln/detail/CVE-2026-58466

---

🤖 本文由 CVE 安全快讯机器人自动生成
英文描述已由 AI 自动翻译为中文，仅供参考，请以原文为准
数据来源: NVD (National Vulnerability Database) | 获取时间: 2026-07-03 08:53