Vulnerability in Remark42 Comment Engine from Umputun Impacts User Data Integrity

CVE-2026-77463

What is CVE-2026-77463?

The Remark42 comment engine, used in a variety of digital platforms, has a vulnerability wherein it indiscriminately trusts specific HTTP headers that may be manipulated by an attacker. This flaw resides in versions ranging from 1.0.0 to 1.16.2, allowing an unauthorized remote actor to exploit the system by injecting fake True-Client-IP, X-Real-IP, and X-Forwarded-For headers. As a result, attackers can circumvent critical vote de-duplication mechanisms and manipulate comment data, potentially leading to a significant compromise of user privacy and the integrity of stored comments and logs. To mitigate this risk, users are strongly advised to upgrade to version 1.16.2 and properly configure the trusted proxy settings to safeguard against untrusted proxies.

References