Authentication Bypass in SuggestArr before 3.0.0 by Giuseppe Barchetta

CVE-2026-113703

What is CVE-2026-113703?

An authentication bypass vulnerability exists in SuggestArr versions prior to 3.0.0. The application’s local_bypass authentication mode improperly validates the client-controlled request.remote_addr value, especially when influenced by the spoofable X-Forwarded-For header. This flaw allows attackers to craft requests that mimic trusted addresses, such as 127.0.0.1, and gain unfettered administrative access to critical API endpoints without proper authentication, potentially compromising user data and system integrity.

References