Missing Authorization Vulnerability in We-MP-RSS Product by Rachelos

CVE-2026-110617

What is CVE-2026-110617?

The We-MP-RSS application versions up to 1.5.3 contain a vulnerability that allows unauthorized users to access and download sensitive export archives via the /api/v1/wx/tools/export/download endpoint. This occurs due to a commented-out authentication dependency in the code, enabling an attacker to exploit this oversight. By providing a specific 'mp_id' alongside a predictable timestamp-based filename, an attacker could retrieve the archive files stored in data/docs. Furthermore, they could manipulate the 'delete_after_download' parameter to erase these files post-download, creating additional security concerns.

References