Authorization Flaw in RansomLook's Database Export Functionality Exposes Private Data

CVE-2026-78370

What is CVE-2026-78370?

RansomLook is affected by an authorization flaw within its legacy database export functionality, enabling unauthenticated remote users to access information that should remain private. The vulnerable /export/ endpoint allows for exporting selected internal databases without authentication, leading to potential leaks of sensitive data. Although some filtering is performed for certain databases, others can be exported without adhering to the application's access restrictions on private entities. As a result, unauthorized users can retrieve sensitive information, including private ransomware intelligence, victim records, and internal tracking data. The recent patch addresses this issue by removing the legacy export route and implementing centralized authorization to ensure that API keys must explicitly be granted access to private data, thus applying consistent filtering across all API responses and database exports.

References