Weakness in MODSetter SurfSense Component Circleback Endpoint
CVE-2026-102245

6.9MEDIUM

Key Information:

Vendor

Modsetter

Status
Surfsense
Vendor
CVE Published:
29 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-102245?

A vulnerability has been identified in the MODSetter SurfSense product, specifically affecting version 2.0.3 or earlier. This flaw resides in an unspecified function within the circleback Endpoint, present in the surfsense_backend/app/routes/circleback_webhook_route.py file. A remote attacker can exploit this weakness to bypass authentication mechanisms, potentially leading to unauthorized access. The discoverer of this vulnerability reached out to the vendor for remediation, but there was no response. This publicly available exploit poses a significant threat to users still operating vulnerable versions of the software.

Affected Version(s)

SurfSense 2.0.0

SurfSense 2.0.1

SurfSense 2.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-102245 - Proof of Concept

References

https://vuldb.com/vuln/411143
vdb-entry
https://vuldb.com/vuln/411143/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-102245
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Snkn0w (VulDB User)
VulDB CNA Team
.